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Generic  Description  of  MECHANICAL  MUTILATION,  cutting  action 


Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  Characteristics 

Equipment  size  varies  by  manufacturer  and  model.  Units  range  in  size  from  small 
desktop  models  to  large,  stand-alone  devices  occupying  many  square  feet  of  floor 
space. 

-  Utility  requirements 

Electrical  power  -  cutting  action  equipment  usually  requires  higher  voltage  (220  volts, 
three  phase)  and  amperage.  Since  cutting  action  increases  die  volume  of  die  de¬ 
stroyed  material  by  at  least  a  factor  of  five,  high  throughput  volume  units  may  require 
some  mechanism  for  transporting  the  cut  up  waste  away  from  the  destruct  equipment 

-  Manpower  requirements 

Generally,  personnel  are  needed  to  access,  remove,  collect  and  transport  the  media  to 
the  shredder  and  feed  diem  into  die  machine.  Specific  information  storage  media  may 
affect  how  this  task  can  be  performed. 


Safety  Concerns 
-  Process 

Generally,  the  process  poses  no  significant  hazards.  Cutting  or  pulverizing  chromi¬ 
um  dioxide  magnetic  recording  media  may  release  toxic  constituents.  Accessing  and 
transporting  specific  media  elements,  in  particular  fixed  media,  may  introduce  haz¬ 
ards. 


-  Materials 

Shredding  does  not  require  any  additional  process-specific  destruct  materials. 
Materials  hazards,  if  any,  can  only  arise  from  the  materials  comprising  the  destroyed 
media. 

-  Accidental  trigger 

Since  destroying  by  mechanical  mutilation  requires  die  active  steps  of  collecting  and 
transporting  the  media  to  the  shredding  device,  there  is  a  low  possibility  of  accidental 
trigger. 

-  Emergency  environment 

Aside  from  the  increased  risk  of  performing  any  task  undo*  adverse  conditions,  the 
emergency  environment  does  not  present  new  or  exacerbate  existing  hazards 
associated  with  the  destruction  process. 


Kfrcfcomprarac 

-  Destruction  spcco 

Cutting  action  destroys  material  rapidly.  Although  the  actual  speed  is  determined  by  a 
combination  of  motor  power  and  the  final  particle  size,  a  single  capacity  load  of 
material  can  usually  be  destroyed  in  less  than  1  minute. 

•  Throughput 

Throughput  is  die  quantity  of  material,  usually  measured  in  pounds,  that  can  be  de¬ 
stroyed  per  unit  time.  There  are  two  critical  elements  of  throughput:  getting  die  media 
to  the  destruct  equipment;  and  actually  cutting  up  the  media.  The  speed  with  which 
die  material  can  be  brought  and  fed  to  the  equipment  is  site,  manpower,  and  media 
specific.  The  actual  cutting  throughput  is  dependent  on  the  horsepower  of  the  ma¬ 
chine,  the  input  throat  dimensions,  the  capacity  of  a  single  load,  the  mechanical  prop¬ 
erties  of  the  medium  (e.g.,  thickness,  hardness),  die  destruction  speed,  and  the  num¬ 
ber  of  destruct  units  available  that  can  be  used  in  parallel 

-  Premature  termination 

It  it  possible  to  terminate  the  cutting  action  prematurely  by  cutting  off  die  electricity  to 
the  machine  or  causing  the  equipment  to  jam.  Some  rotary  knife  mills  can  be 
prooued  with  a  generator  to  supply  electric  power  in  the  event  of  a  power  outage 
during  the  emergency.  The  process  can  also  terminate  prematurely  if  the  equipment 
malfunctions.  Such  malfunctions  are  more  likely  on  lower  power,  lower  duty  cycle 
machines  that  are  forced  to  tun  at  maximum  capacity  in  an  emergency. 

-  Destruction  completeness 

Depends  on  specific  equipment-medium  factors.  Cutting  action  produces  a  variety  of 
panicle  sizes  and  shapes:  strips,  cross-cut  strips,  particles  (rotary  knife  mills),  and 
hammermill  "dust".  The  size  and  shape  of  the  shards,  in  conjunction  with  the  storage 
density  of  the  specific  medium,  determine  die  degree  of  destruction  completeness. 

-  Detectability 

Mechanical  mutilation  is  accompanied  by  some  level  of  equipment  noise.  In  particu¬ 
lar,  high  power  rotary  knife  mills  tend  to  be  very  loud  As  such,  the  fact  that 
destruction  is  being  carried  out  may  be  detected  at  some  point  outside  the  immediate 
vicinity  of  die  destruct  area. 

-  Information  concentration 

Depends  on  specific  medium  and  local  facility  factors.  Information  is  usually  spread 
throughout  die  facility.  Information  frequently  will  be  concentrated  in  file  cabinets, 
bookcases,  tape  racks,  desk  tops  or  internally  throughout  the  information  processing 
equipment  Since  most  information  is  rarely  cataloged  and  stored  by  sensitivity  cate¬ 
gory,  a  major  task  may  be  die  identification  and  separation  of  highly  sensitive  infor¬ 
mation  from  less  sensitive  material 


-  Medium 


Depends 
cutty  and 


on 


medium,  local  facility  and  specific  equipment  factors.  Thediffi- 
aad  complexity  of  accessing  media  is  set,  in  part,  tty  the  specific  medium  and 
whether  it  was  designed  to  be  fixed  or  removable.  The  removal  of  fixed  media  may 
be  relatively  complex  and  require  special  tools  and  training.  Both  fixed  and  remov¬ 
able  media  may  be  stored  in  secure  containers  or  housings,  which  in  turn  may  delay 
accessing  the  actual  media. 
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State  of  Destruct  Technology 

Mechanical  mutilation  technology  is  highly  evolved.  A  variety  of  products  are  avail¬ 
able  from  numerous  vendors.  Some  products  have  been  tested  and  approved  for 
DoD  use  for  the  destruction  of  classified  documents.  The  list  of  such  products  is 
maintained  and  regularly  updated  by  the  National  Security  Agency. 
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Des  tract  Method:  MECHANICAL  MUTILATION,  cuning  action 
Storage  Medium:  Semiconductor,  All  Types 
Effectiveness:  Medium  to  Poor 

Process: 

The  silicon  die  within  the  device  package  is  broken  into  tiny  fragments  to  preclude  the 
recovery  of  information. 

Destruction  Issues: 

System  Overhead  Cooccras 

-  Manpower  requirements 

Personnel  are  needed  to  access  and  remove  circuit  cards  with  memory  components. 
If  the  cards  are  not  removable,  die  semiconductor  package  must  be  separated  from  the 
circuit  card.  This  procedure  requires  special  tods  and  training.  The  circuit  cards  or 
components  need  to  be  transported  to  the  destruct  equipment  and  fed  into  the  ma¬ 
chine. 


Safety  Concerns 
-  Process 

Electrical  shock  is  possible  if  information  processing  equipment  is  not  powered  down 
before  personnel  attempt  to  access  memory  elements.  High  voltage  may  be  retained 
by  some  capacitors  even  after  external  power  is  removed. 


Risk  of  compromise 

-  Destruction  completeness 

Ranges  from  poor  to  excellent.  Equipment  that  is  designed  to  destroy  circuit  cards 
may  result  in  individual  fragments  large  enough  to  allow  completely  intact  or  signifi¬ 
cantly  large  fragments  of  the  silicon  die  surviving  the  destruct  process.  Special  in¬ 
vestigative  techniques  can  be  used  to  extract  the  information  content  of  the  original 
memory  from  such  fragments. 


-  Information  concentration 

The  information  to  be  destroyed  resides  within  device  components  of  electronic 
equipment  that  may  be  dispersed  throughout  a  facility.  An  additional  dispersing  ef¬ 
fect  arises  from  the  difficulty  of  easily  identifying  and  separating  memory  compo¬ 
nents  from  other  device  components.  Furthermore,  only  memory  components  that 
have  stored  sensitive  information  need  to  be  destroyed,  but  there  is  no  easy  method  to 
identify  those  specific  components. 

•  Medium  accessibility 

Poor  to  very  poor.  The  silicon  die  is  mounted  within  a  hermetically  sealed  compo¬ 
nent  package,  which  is  mounted  along  with  other  components  on  a  circuit  card.  The 
circuit  card,  in  turn,  is  mounted  with  other  components  and  circuit  cards  onto  a  chas¬ 
sis  and  housed  within  a  sealed  cabinet  The  cabinet  itself  may  be  further  secured  in 
an  equipment  rack,  or  with  some  other  mounting  scheme. 
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State  of  Destruct  Technology 

Mott  cutting  action  equipment  is  not  appropriate  for  destroying  semiconductor 
memories  -  die  motors  and  cutting  bladea  are  simply  not  powerful  enough  to  cut 
through  the  combination  of  ceramic,  plaatic,  fiberglass  and  metal  materials  round  on 
circuit  cards.  Some  rotary  knife  mills  (with  motor  ratings  exceeding  3  horsepower) 
are  powerful  enough  to  handle  complete  circuit  cards.  This  equipment,  however, 
yields  fragments  that  are  large  enough  to  permit  complete  semiconductor  dies  to  be 
recovered  following  destruction.  Smaller  desktop  units  resembling  blenders  do  a 
reasonable  job  of  destroying  the  memory  element,  but  require  that  die  package  be 
removed  from  the  circuit  card.  Some  even  require  that  the  silicon  die  be  extracted 
from  the  package.  Such  labor  and  time  intensive  practices  are  not  practical  in  an 
emergency  environment 


Discussion: 

Semiconductor  memories  are  difficult  to  destroy  with  cutting  action  mechanical  muti¬ 
lation  because  die  memories'  tiny,  high  information  storage  density  silicon  dies  are 
contained  within  so  many  successive  housings.  These  containers  add  significantly  to 
the  total  volume  of  material  dud  must  be  destroyed  to  assure,  to  a  high  degree,  that  the 
actual  silicon  dies  within  them  are  adequately  destroyed. 
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Destruct  Method:  MECHANICAL MUTILATION,  catting  action 
Storage  Medium:  Magnetic,  Recording,  Tape,  Reel-to-Recl 
Effectiveness:  Medium 

Process: 

The  magnetic  recording  medium  it  cut  into  tiny  fragment!  to  randomize  the  informa¬ 
tion  content  and  to  preclude  information  recovery. 

Destruction  Issues: 

Risk  of  compromise 

-  Destruction  completeness 

Medium.  The  degree  of  completeness  depends  on  the  final  size  of  the  shards.  Half 
inch  reel-to-rcel  tapes  More  information  at  dcnaitica  up  to  1 12  Kbits  per  square  inch. 
At  theae  densities,  even  shards  1/64  of  an  inch  on  a  sue  contain  about  27  bits.  This 
amount  of  information  corresponds  to  die  equivalent  of  3.5  letters  of  text  or  about 
half  a  word.  Most  cutting  equipment  does  not  achieve  even  this  fine  a  particle  size. 

-  Information  concentration 

Tapes  are  frequently  stored  on  racks  in  tape  libraries  or  vaults.  They  also  can  be  dis¬ 
tributed  throughout  a  facility:  in  desk  drawers,  in  files,  etc. 

•  Medium  accessibility 

Tapes  found  at  a  facility  may  contain  both  sensitive  and  routine  information.  Unless 
the  reels  have  security  mmkmgs  or  the  contents  are  indexed,  identification  and  priori¬ 
tization  of  tapes  for  destruction  may  be  difficult  The  medium  is  highly  accessible 
unless  stored  in  secure  containers. 


State  of  Destruct  Technology 

No  shredders  have  been  identified  that  specifically  address  die  destruction  of  reels-to- 
reel  tapes. 


Discussion: 

Facilities  that  utilize  tapm  for  information  storage  also  tend  to  generate  large  quantities 
of  data.  As  such,  tape  libraries  usually  contain  hundreds  of  reels  of  tape. 

Cutting  equipment's  ability  to  destroy  tapes  may  be  affected  by  the  reel  material  and 
the  effect  of  die  tapes  themselves  being  tightly  wound  on  reds.  Some  equipment  may 
not  have  an  input  throat  that  can  accept  the  almost  one  inch  thick  reels,  or  may  not 
have  sufficient  cutting  ability  to  cut  through  the  mass  of  the  Mylar  and  reel.  The 
Mylar  base  of  the  tapes  may  cause  gumming  of  the  cutting  mechanism. 


Destroct  Method:  MECHANICAL  MUTILATION,  cutting  action 
Storage  Medium:  Magnetic,  Recording,  Tape,  Cartridges  (Cassettes,  Wafers) 
Effectiveness :  Medium  to  Poor 

Process: 

The  magnetic  recording  medium  is  cut  into  tiny  fragments  to  randomize  the  informa¬ 
tion  content  and  to  preclude  information  recovery. 

Destruction  Issues: 

Safety  Concerns 

-  Process 

There  has  been  some  concern  expressed  that  cutting  action  may  release  highly  toxic 
hexavaknt  chromium  compounds  if  the  new  chromium  dioxide  tapes  are  subjected  to 
cutting  action.  Since  chromium  dioxide  tapes  are  a  new  medium,  there  is  little  infor¬ 
mation  on  potential  health  hazards. 


-  Destruction  completeness 

Medium  to  poor.  The  degree  of  completeness  depends  on  the  final  size  of  the  shards. 
Half  and  quarter  inch  cartridge  tapes  store  information  at  densities  up  to  1.4  Mbits  per 
square  inch.  At  these  densities,  even  shards  1/64  of  an  inch  on  a  side  contain  about 


square  in 

334  bits.  This  amount  of  information  corresponds 
text  or  about  2/3  of  a  printed  line  of  text  Most  a 
achieve  even  this  fine  a  particle  size. 


This  amount  of  information  < 


Is  to  the  equivalent  of  42  letters  of 
cutting  action  equipment  does  not 


Information  concentration 

Tape  media  cartridges  can  be  distributed  throughout  a  facility:  in  desk  drawers,  in 
fries,  etc. 


Medium  accessibility 

Cartridges  found  at  a  facility  may  contain  both  sensitive  and  routine  information. 
Unless  the  the  containers  have  security  markings  or  the  contents  are  indexed, 
identification  and  prioritization  of  cartridges  for  destruction  may  be  difficult  The 
medium  is  highly  accessible  unless  stored  in  secure  containers. 


State  of  Dcatruct  Technology 


No  equipment  has  been  identified  that  specifically  addresses  the  destruction  of  car¬ 
tridge  tapes. 


Discussion: 

The  equipment's  ability  to  destroy  the  actual  tapes  may  be  affected  by  the  properties 
of  the  cartridge  case  material  and  the  effect  of  the  tapes  themselves  being  tightly 
wound  on  hubs.  Some  cutting  equipment  may  not  have  an  input  throat  that  can  ac¬ 
cept  the  almost  one  inch  thick  cartridges,  or  may  not  have  sufficient  cutting  ability  to 
cm  through  the  mass  of  Mylar.  The  Mylar  base  of  the  tapes  may  cause  gumming  of 
the  cutting  mechanism,  the  quarter  inch  and  some  0.15  inch  cartridges  contain  a 
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thick  metal  plate  that  may  interfere  with  the  cutting  action.  The  new  IBM  half-inch 
cartridge  contains  large  metal  parts  inside. 


Destruct  Method:  MECHANICAL  MUTILATION,  cutting  action 
Storage  Medium:  Magnetic,  Recording,  Floppy  Disks 
Effectiveness:  Medium  to  Poor 

Process: 

The  magnetic  recording  medium  is  cut  into  tiny  fragments  to  randomize  the  informa¬ 
tion  content  and  to  preclude  information  recovery. 

Destruction  Issues: 


Risk  of  compromise 

-  Destruction  completeness 

Medium  to  poor.  The  degree  of  completeness  depends  cm  die  final  size  of  the  shards. 
Floppy  disks  are  a  relatively  high  density  storage  medium  with  densities  up  to  2 
Mbits  per  square  inch.  At  these  densities,  even  shards  1/64  of  an  inch  on  a  side  con¬ 
tain  almost  490  bits.  This  amount  of  information  corresponds  to  the  equivalent  of  61 
letters  of  text  or  about  one  printed  line.  Most  cutting-based  destruct  equipment  does 
not  achieve  even  this  fine  a  particle  size. 

-  Information  concentration 

Floppy  diskettes  are  compact,  rugged,  and  relatively  portable.  As  such,  they  tend  to 
be  distributed  throughout  a  facility:  in  desk  drawers,  in  fries,  etc. 

-  Medium  accessibility 

Floppy  disks  found  at  a  facility  may  contain  both  sensitive  and  routine  information. 
Unless  the  die  disks  have  security  markings  or  die  contents  are  indexed,  identification 
and  prioritization  of  disks  for  destruction  may  be  difficult  The  medium  is  highly  ac¬ 
cessible  unless  stored  in  secure  containers. 


State  of  Destruct  Technology 

No  equipment  has  been  identified  that  specifically  addresses  the  destruction  of  floppy 
disks. 


Discussion: 

The  metal  constituents  and  hard  plastic  shell  of  the  3-1/2  inch  diskettes  may  present  a 
problem  to  some  lower  power  shredders.  The  thickness  of  soft  jackets  of  the  5-1/4 
and  8  inch  diskettes  should  pose  no  problems  for  shredders.  The  Mylar  base  of  the 
diskettes  or  plastic  components  of  the  jackets  may  cause  gumming  of  the  cutting 
mechanism. 
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Dcstruct  Method:  MECHANICAL  MUTILATION,  cutting  action 
Storage  Medium:  Magnetic,  Recording,  Hard  Disks,  Removable 
Effectiveness:  Poor  to  Very  Poor 


Process: 

The  magnetic  recording  medium  is  cut  into  tiny  fragments  to  randomize  the  informa¬ 
tion  content  and  to  preclude  information  recovery. 

Destruction  Issues: 

Risk  of  compromise 

-  Destruction  completeness 

Poor  to  very  poor.  It  is  not  expected  that  cutting  action  is  a  viable  mechanism  for  de¬ 
stroying  hard  disks. 

-  Information  concentration 

Harddisks  tend  to  be  stored  in  die  proximity  of  the  associated  disk  drive. 

-  Medium  accessibility 

Medium  is  highly  accessible  unless  stored  in  secure  containers. 


State  of  Dcstruct  Technology 

No  equipment  has  been  identified  that  is  designed  specifically  for  the  destruction  of 
removable  hard  disks. 


Discussion: 

Rotary  knife  mills  are  the  only  cutting  devices  that  could  handle  the  hand  materials 
found  in  cartridges  and  disk  packs.  Rotary  knife  mills,  however,  cannot  cut  through 
die  hub  material  of  the  14  inch  disk  cartridges  and  packs  Such  cartridges  and  packs 
would  have  to  be  disassembled  before  destruction,  and  the  hubs  removed.  Even  after 
passing  through  the  cutting  mechanism,  the  individual  shards  of  disk  material  still 
contain  a  significant  amount  of  stored  information  (in  excess  of  several  pages  of  text) 
because  of  the  high  storage  density  of  hard  disks. 


Dcstruct  Method:  MECHANICAL  MUTILATION,  cutting  action 
Storage  Medium:  Magnetic,  Recording,  Hard  Disks,  Fixed 
Effectiveness:  Not  applicable/practical 

Discussion: 

Fixed  hard  disks  are  mounted  in  user  inaccessible,  sealed  containers.  This,  coupled 
with  the  inability  of  cutting  action  to  adequately  destroy  removable  hard  disks,  makes 
cutting  action  a  non- viable  method  for  fixed  hard  disk  destruction  in  an  emergency 
environment. 


Destruct  Method:  MECHANICAL  MUTILATION,  cutting  action 
Storage  Medium:  Magnetic,  Recording,  Drums 
Effectiveness :  Not  applicable/practical 

Discussion: 

Magnetic  drums  consist  of  a  metal  drum  that  may  present  problems  for  shredder  cut¬ 
ting  mechanisms.  The  drum  itself  is  difficult  to  access,  and  the  cylindrical  shape  of 
die  drum  memory  element  may  present  problems  for  destruct  equipment  designed  to 
accept  flat  material.  It  is  speculated  that  some  of  the  very  high  power  rotary  knife 
mi11«  may  be  capable  of  destroying  drums. 
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Destruct  Method:  MECHANICAL  MUTILATION,  cutting  action 
Storage  Medium:  Magnetic,  Current- Accessed  (Core,  Twirtor,  Plated  Wire) 
Effectiveness:  Possibly  Medium  to  High 

Process: 

The  memory  planes  me  physically  destroyed  by  fragmenting  and  randomizing  the  in¬ 
dividual  components. 

Destruction  Issues: 

System  Overhead  Concerns 
-  Manpower  requirements 

Personnel  are  needed  to  access  and  remove  memory  array  cards,  transport  them  to, 
and  feed  them  into  die  destruct  machine.  This  procedure  requires  special  tools  and 
training. 


Safety  Concerns 
-  Process 

Electrical  shock  is  possible  if  information  processing  equipment  is  not  powered  down 
before  personnel  attempt  to  access  memory  elements.  High  voltage  may  be  retained 
by  some  capacitors  even  after  external  power  is  removed. 


Riskofcompromac 

-  Destruction  conqdeteness 

Excellent  Rotary  knife  mill*  designed  to  destroy  circuit  cards  can  destroy  current- 
accessed  magnetic  memories.  Equipment  that  does  not  have  sufficient  power  to  break 
apart  the  memory  assembly  leaves  die  information  contents  recoverable. 

-  Information  concentration 

The  information  storing  elements  tend  to  reside  in  the  main  computing  processor. 
The  individual  components  are  readily  identifiable  by  their  characteristic  appearance. 

-  Medium  accessibility 

Poor  to  very  poor.  The  memory  elements  are  within  closed  chassis  and  may  be  diffi¬ 
cult  to  access.  Furthermore,  the  physical  removal  of  the  memory  planes  may  be 
difficult 


State  of  Destruct  Technology 

Current-accessed  memories  can  be  destroyed  only  by  units  powerful  enough  to  han¬ 
dle  complete  circuit  cards.  These  higher  power  units  have  motors  in  excess  of  3 
horsepower  and  specially  hardened  cutting  blades. 


Discussion : 

Core,  twister,  and  plated  wire  memories  are  low  density  storage  media  and  breaking 
them  up  into  small  fragments  is  an  effective  method  of  destroying  their  information 
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contest  The  infbemalioa  content  of  con  memories  can  be  destroyed  by  simply  sepa¬ 
rating  the  ferrite  cores  from  die  wire  matrix.  Since  each  core  represents  only  one  bit 
of  stared  information,  physical  randomization  of  the  cores  is  sufficient  to  destroy  the 
information  content  even  if  die  cores  remain  magnetized.  The  main  concern  for 
emergency  destruction  is  whether  the  memories  can  be  removed  quickly  from  the 
equipment 
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Dcstrnet  Method:  MECHANICAL  MUTILATION,  cutting  action 
Storage  Medium:  Magnetic,  Bubble 
Effectiveness:  Possibly  Medium  to  High 

Process: 

Either  the  bubble  material  die  within  the  device  package  is  broken  into  tiny  fragments 
to  preclude  die  recovery  of  information,  or  the  vertical  magnetic  bias  field  source  is 
separated  from  die  package,  causing  the  bubble  domains  to  collapse. 

Destruction  Issues: 

System  Overhead  Concerns 
-  Manpower  requirements 

Personnel  are  needed  to  access  and  remove  circuit  cards  with  bubble  memory 
components.  If  the  cards  are  not  removable,  the  bubble  memory  package  must  be 
separated  from  the  circuit  card.  This  procedure  requires  special  tools  and  training. 
The  circuit  amis  or  components  need  to  be  transported  to  and  fed  into  the  machine. 


Safety  Concerns 
-  Process 

Electrical  shock  is  possible  if  information  processing  equipment  is  not  powered  down 
before  personnel  attempt  to  access  memory  elements.  High  voltage  may  be  retained 
by  some  capacitors  even  after  external  power  is  removed. 


Risk  of  compromise 

-  Destruction  completeness 

Possibly  excellent  Rotary  knife  mills  must  have  sufficient  power  and  strong  enough 
blades  to  destroy  the  bubble  memory  contents  by  breaking  apart  the  memory  module. 

-  Information  concentration 

The  information  elements  reside  in  electronic  equipment  the  various  components  of 
which  may  be  dispersed  throughout  a  facility.  An  additional  dispersing  effect  arises 
from  the  difficulty  of  easily  identifying  and  separating  the  specific  memory  compo¬ 
nents  from  the  other  electronic  components. 

-  Medium  accessibility 

Poor  to  very  poor.  The  bubble  memory,  including  die  magnetic  field  generating  ele¬ 
ments,  is  mounted  within  a  hermetically  sealed  component  package,  which  is  mount¬ 
ed  along  with  other  components  on  a  circuit  card.  'Die  circuit  card,  in  turn,  is  mount¬ 
ed  with  other  components  and  circuit  cards  onto  a  chassis  and  housed  within  a  closed 
cabinet  The  cabinet  may  be  mounted  in  an  equipment  rack  or  further  contained 
within  a  physical  security  housing. 


State  of  Destruct  Technology 

Most  shredders  and  hammermills  are  not  appropriate  for  destroying  bubble  memories 
-  the  motors  and  cutting  blades  are  simply  not  powerful  enough  to  cut  through  the 
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combination  of  ceramic,  plastic,  fiberglass  and  metal  materials  found  on  circuit  cards, 
and  comprising  die  bubble  memory  module.  Most  rotary  knife  mill*  are  powerful 
enough  to  handle  complete  circuit  cards  and,  therefore,  bubble  memory  modules. 
These  higher  power  units  have  motors  in  excess  of  3  horsepower  and  specially 
hardened  cutting  blades. 


Discussion: 

Reports  verifying  the  effectiveness  of  mechanical  mutilation  based  on  cutting  action  in 
destroying  bubble  memories  have  not  been  found.  It  is  conjectured  that  the  informa¬ 
tion  content  of  bubble  memories  can  be  destroyed  effectively  with  rotary  knife  mUls  if 
die  rotary  knife  mill  separates  die  bubble  memory  die  from  the  permanent  magnet  in 
the  module  that  supplies  the  bias  field.  Once  this  field  is  removed,  the  bubble 
domains  collapse  into  the  random,  snake-like  domains,  thereby  destroying  the 
contents  of  die  memory  element  The  actual  effectiveness  of  this  destruct  technique 
needs  to  be  verified  by  a  field  test 


Destruct  Method:  MECHANICAL  MUTILATION,  cutting  action 
Storage  Medium:  Optical,  Microform 
Effectiveness:  Medium  to  Poor 

Process: 

The  microform  film  storage  medium  is  cut  into  tiny  fragments  to  randomise  the  in¬ 
formation  content  and  to  preclude  information  recovery. 

Destruction  Issues: 

RjArfcnrnnwMMM; 

•  Destruction  completeness 

Medium  to  poor.  The  degree  of  completeness  depends  on  die  final  sue  of  the  shards. 
The  jquipment  that  pulverizes  the  medium  or  that  forms  confetti-like  shards  provides 
a  reasonable  degree  of  destruction.  Shredders  that  cut  the  medium  into  strips  leave 
the  information  largely  recoverable. 

-  Information  concentration 

Microforms  are  small  and  highly  portable.  Microfilm  on  reels  tends  to  be  housed  in 
protective  boxes  and  stored  in  special  file  cabinets.  Microfiche  are  housed  in  protec¬ 
tive  paper  sleeves  and  are  likewise  frequently  stored  in  cabinets.  Because  they  are  flat 
and  readily  available  in  "user  copies,"  microfiche  tend  to  be  distributed  throughout  a 
facility:  in  desk  drawers,  in  files,  etc. 


State  of  Destruct  Technology 

Specific  devices  have  been  designed  for  destroying  microforms.  The  plastic  base  of 
microforms  has  a  tendency  to  gum  and  jam  die  cutting  mechanisms  of  some  equip¬ 
ment  Likewise,  the  reels  and  housing  of  microfilm  rolls  and  cartridges  may  present 
problems  (throat  opening  may  not  be  large  enough,  or  the  shredders  may  not  be  ca¬ 
pable  of  handling  that  material).  If  the  film  has  to  be  removed  from  the  reels  or  car¬ 
tridges,  throughput  will  be  significantly  reduced. 


Discussion: 

Sandia  National  Laboratories  has  performed  an  unpublished  study  on  the  amount  of 
time  necessary  to  reconstruct  cut  up  microforms  as  a  function  of  shard  size  and  initial 
volume  of  material  (degree  of  information  randomization).  Charles  Clark, 
Reassembly  of  Microfiches  After  Destruction  by  a  Dry  Disintegrator,  Sandia  National 
Laboratories,  December  1976. 
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Destroet  Method:  MECHANICAL  MUTILATION,  cutting  action 
Storage  Medium:  Optical,  Laser-Accessed 
Effectiveness:  Possibly  Medium  to  Poor 

Process: 

The  Stonge  medium  is  cut  into  tiny  fragments  to  randomise  the  information  content 
and  to  preclude  recovery  by  standard  readout  equipment 

Destruction  Issues: 

Safety  Concerns 
-  Materials 

The  hazards  of  exposure  to  some  of  the  optical  storage  materials  themselves  (e.g., 
tellurium  compounds  and  alloys  in  the  WORM  type  media)  have  not  been  thoroughly 
investigated.  During  normal  medium  use,  these  materials  are  encapsulated,  and  not 
likely  to  contact  personnel.  Cutting  the  medium  apart  may  expose  personnel  to  these 
materials  with  unknown  health  effects. 


Risk  of  compromise 

-  Destruction  completeness 

Medium  to  poor.  Laser-accessed  optical  storage  media  are  extremely  high  density 
media.  In  die  case  of  equipment  that  cuts  the  media  into  tiny  pieces,  die  output 
shards,  even  1/64  inch  on  the  side,  still  contain  considerable  amounts  of  information; 
well  in  excess  of  die  contents  of  a  printed  page  of  text  It  is  possible,  however,  that 
rotary  knife  mills  may  disintegrate  the  optical  media  sufficiently  to  preclude 
information  recovery.  More  research  in  this  area  is  necessary. 

-  Information  concentration 

Individual  media  elements  (e.g.,  discs,  tapes)  can  contain  tremendous  amounts  of  in¬ 
formation  in  a  relatively  small  volume.  The  individual  media  elements  are  highly 
portable  and  rugged.  Thus,  they  can  be  stored  in  any  manner  consistent  with  facility 
security  requirements. 

-  Medium  accessibility 

Medium  is  highly  accessible  unless  stored  in  secure  containers. 


State  of  Destruct  Technology 

Laser-accessed  optical  storage  is  a  new  storage  technology.  As  a  result,  the  manu¬ 
facturers  of  mechanical  mutilation  equipment  have  not  yet  addressed  the  problem  of 
destroying  laser-accessed  storage  media.  Equipment  capable  of  handling  microforms 
should  be  capable  of  handling  plastic  substrate  optical  storage  media.  Glass  or  metal 
substrates  may  present  a  problem  for  many  cutting  action  equipment  types. 


Discussion: 

Laser-accessed  optical  storage  media  are  not,  as  yet,  widely  distributed.  This 
technology  is  experiencing  rapid  growth  and  shortly  will  be  widely  used. 
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Dcstruct  Method:  MECHANICAL  MUTILATION,  cutting  action 
Storage  Medium:  Punched,  Cards 
Effectiveness:  High 

Process: 

The  computer  card  is  cut  into  tiny  fragments  or  strips  to  randomize  the  information 
content  arid  to  preclude  information  recovery. 

Destruction  Issues: 

Risk  of  compromise 

-  Destruction  completeness 

Excellent  The  low  density  of  information  storage  makes  cutting  highly  appropriate 
for  computer  card  destruction. 

-  Information  concentration 

Computer  cards  tend  to  be  stored  in  file  cabinets  designed  for  their  size,  in  cardboard 
boxes  holding  up  to  2,000  cards,  or  in  stacks  simply  bound  with  elastic  bands. 
Although  cards  can  be  located  virtually  anywhere  in  a  facility,  they  tend  to  be  in  dis¬ 
creet  clusters. 

-  Medium  accessibility 

Readily  accessible  unless  stored  in  secure  containers. 


Discussion: 

The  relative  thickness  (99  pound  paper)  of  the  card  stock  may  limit  the  possible  cut¬ 
ting  speed  of  lower  power  desk  top  shredders.  Most  equipment,  however,  should 
have  no  difficulty  in  destroying  die  medium.  Manufacturers  tend  to  identify  specific 
models  as  more  appropriate  for  computer  card  destruction. 

Because  computer  cards  are  a  low  storage  density  medium,  the  physical  volume  of 
cards  at  a  facility  may  be  large.  Furthermore,  the  computer  card  is  an  obsolete  stor¬ 
age  medium  that  is  in  the  process  of  being  phased  out  More  data  is  necessary  to  es¬ 
tablish  the  actual  quantity  of  cards  that  can  be  expected  to  be  found  at  a  facility. 
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Destruct  Method:  MECHANICAL  MUHLATOON,  catling  action 
Storage  Medium:  Punched,  Tape 
Effectiveness:  High 

Process: 

The  punched  tape  is  cut  into  tiny  fragments  or  strips  to  randomize  die  information 
content  and  to  preclude  information  recovery. 

Destruction  Issues: 


•  Destruction  completeness 

Excellent  The  low  density  of  information  storage  makes  cutting  action  highly 
appropriate  for  punched  tape  destruction. 

-  Information  concentration 

Punched  tapes  tend  to  be  wound  on  reels  up  to  14  inches  in  diameter,  stored  as  coils, 
or  fanfolded  in  containers. 


Discussion: 

The  reds  themsdves  may  present  problems  to  some  equipment  Therefore,  it  may  be 
necessary  to  unwind  die  tape  in  order  to  destroy  it  This,  in  turn,  adds  to  die  destruct 
time.  Plastic  tapes  may  gum  up  the  cutting  mechanisms  of  some  shredders. 


Destruct  Method:  MECHANICAL  MUTILATION,  cutting  action 
Storage  Medium:  Papa1,  All  Types 
Effectiveness:  Medium  to  High 

Process: 

The  paper  is  cut  into  tiny  fragments  or  strips  to  randomize  the  information  content  and 
to  preclude  information  recovery. 

Destruction  Issues: 

Safety  Coocam 

-  Process 

Hammennills  generate  fine  dust  The  fine  dust  can  explode  if  die  proper  mixture  of 
air  and  dust  is  permitted  to  form.  Such  a  mixture  can  be  detonated  with  a  spark  or 
open  flame.  Tbc  effect  is  analogous  to  grain  silo  and  flour  mill  dust  explosions. 
Furthermore,  high  concentrations  of  dust  can  present  a  respiratory  hazard. 


Risk  of  compromise 

-  Instruction  completeness 

Poor  to  excellent  Rotary  knife  mills  and  shredders  that  produce  crosscut  particles 
provide  an  excellent  degree  of  information  destruction  of  text  documents.  Shredders 
that  merely  cut  the  paper  into  strips  leave  the  information  recoverable,  albeit  with  a 
considerable  degree  of  effort  required  on  the  adversaries'  part  Shredders  offer 
medium  to  poor  destruction  completeness  of  software  strips  due  to  their  high  density 
of  information  storage.  Hammermills  offer  an  excellent  degree  of  destruction 
completeness  for  all  paper  media. 

-  Information  concentration 

Paper  tends  to  be  randomly  distributed  everywhere  throughout  a  facility.  Some  de¬ 
gree  of  information  concentration  exists  in  the  form  of  file  cabinets  and  bookshelves. 

-  Medium  accessibility 

Readily  accessible  unless  stored  in  secure  containers.  The  major  difficulty  is  not  get¬ 
ting  to  the  material  itself,  but  rather,  separating  the  sensitive  material  from  the  sheer 
volume  of  routine  material 


Discussion: 

Most  strip  and  crosscut  shredders  are  not  harmed  by  occasional  small  metal  pieces, 
such  as  staples  or  paper  clips.  Bound  documents  may  present  some  problems  to 
smaller  shredders.  The  input  throat  may  be  able  to  accept  only  thin  stacks  of  paper. 
As  a  result,  bound  documents  may  need  to  be  broken  apart  and  hard  covers  (such  as 
ring  binders)  removed  prior  to  destruction.  Rotary  knife  mills  have  less  of  a  problem 
with  both  metal  constituents  and  bound  documents. 

t 

Sandia  National  Laboratories  has  performed  a  study  on  the  amount  of  time  necessary 
to  reconstruct  shredded  paper  as  a  function  of  shard  sire  and  initial  volume  of  material 
(degree  of  information  randomization).  Charles  Clark  and  Alan  Swain,  Shredded 
Document  Reassembly  Study,  SAND  76-0320,  October  1976. 
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Generic  Description  of  MECHANICAL  MUTILATION,  abrasive  action 


Destruction  Issues: 

System  Overhead  Concerns 
-  Physical  Characteristics 

The  process  requires  minimal  equipment  The  required  abrasives  are  compact  and 
easily  stored.  Hand-held  power  tools  can  be  used  to  speed  up  die  destruct  process. 


Utility  requirements 

Hand-held  power  tools  require  either  electricity  or  batteries  to  operate. 

Manpower  requirements 

Generally,  personnel  are  needed  to  identify,  access  and  remove  the  media.  The  de¬ 
struct  process  is  manual  and  is  performed  by  personnel. 


Safety  Concerns 

-  Process 

Generally,  the  process  poses  no  significant  hazards.  Abrasive  action  applied  to 
chromium  dioxide  magnetic  recording  media  may  release  toxic  constituents. 
Accessing  and  transporting  specific  media  elements,  in  particular  fixed  media,  may 
introduce  electrical  shock  hazards. 

-  Materials 

Abrasive  action  does  not  require  any  hazardous  process-specific  destruct  materials. 
Materials  hazards,  if  any,  can  only  arise  from  the  materials  comprising  the  destroyed 
media. 

-  Accidental  trigger 

Since  destroying  by  mechanical  mutilation  requires  the  active  steps  of  collecting  or 
accessing  the  media,  there  is  a  low  possibility  of  accidental  trigger. 

-  Emergency  environment 

Aside  from  the  increased  risk  of  performing  any  task  under  adverse  conditions,  the 
emergency  environment  does  not  present  new  or  exacerbate  existing  hazards 
associated  with  the  destruction  process. 


Risk  of  compromise 

-  Destruction  speed 

Abrasive  action  is  a  slow  process.  Access  to  the  appropriate  part  of  the  medium  may 
take  some  time  and  the  destruct  process  itself  is  labor  intensive  and  time-consuming. 

•  Throughput 

The  throughput  is  dependent  on  the  specific  medium  and  the  skill  of  the  personnel 
performing  the  task. 


-  Premature  termination 

The  personnel  performing  the  des tract  task  can  be  interrupted  and  prevented  from 
completing  die  process. 

-  Destruction  completeness 

Depends  on  the  skill  and  thoroughness  of  the  personnel.  Careless  workmanship  can 
leave  patches  of  information  storing  media  intact 


-  Detectability 

The  des  tract  process  is  not  detectable  from  outside  the  immediate  vicinity  of  the  dc- 
s  tract  area. 


-  Information  concentration 

Depends  on  specific  medium  and  local  facility  factors.  Information  frequently  will  be 
concentrated  in  file  cabinets  or  bookcases.  Since  information  is  rarely  cataloged  and 
stored  by  sensitivity  category,  a  major  task  may  be  die  identification  and  separation  of 
highly  sensitive  information  from  less  sensitive  material. 

-  Medium  accessibility 

Depends  on  specific  medium,  local  facility  and  specific  equipment  factors.  The  diffi¬ 
culty  and  complexity  of  accessing  media  is  set,  in  part,  by  the  specific  medium,  and 
whether  it  was  designed  to  be  fixed  or  removable.  The  removal  of  fixed  media  may 
be  relatively  complex  and  require  special  tools  and  training.  Both  fixed  and  remov¬ 
able  media  may  be  stored  in  secure  containers  or  housings,  which  in  turn  may  delay 
accessing  die  actual  media. 


State  of  Destruct  Technology 

Abrasive  action  is  a  crude,  but  effective,  method  of  destroying  information  stored  on 
fixed  hard  disks.  Virtually  any  abrasive,  such  a  sandpaper  or  cleaning  scouring 
powder,  can  be  applied  manually  or  with  a  power  tool,  such  as  a  power  sander  or 
grinding  wheel  It  is  conjectured  that  abrasive  action  destruction  could  be  a  designed- 
in  feature  of  some  information  storage  equipment  Research  is  necessary  to  verify 
this  possibility. 
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Des  tract  Method:  MECHANICAL  MUTILATION,  abrasive  action 
Storage  Medium:  Semiconductor,  All  Types 
Effectiveness:  NotqjpbcaMe/practical 

Discussion: 

Abrasive  action  would  have  to  be  applied  directly  to  die  surface  of  die  silicon  die 
which  would  have  to  be  removed  from  its  package.  This  elaborate  procedure  is  not 
practical  in  an  emergency  environment 
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Destruct  Method:  MECHANICAL  MUTILATION,  abrasive  action 
Storage  Medium:  Magnetic,  Recording,  Tape,  Reel-to-Reel 
Effectiveness:  Not  applicable/practical 

Discussion: 

Although  abrasive  action  can  remove  the  thin  magnetic  layer  on  tape  media,  the  sheer 
length  of  the  tape  on  reels  renders  this  approach  impractical  due  to  the  amount  of  time 
and  effort  required  to  accomplish  destruction. 


Destruct  Method:  MECHANICAL  MUTILATION,  abrasive  action 
Storage  Medium:  Magnetic,  Recording,  Tape,  Cartridges  (Cassettes,  Wafers) 
Effectiveness:  Not  appiicabk/practical 

Discussion: 

Although  abrasive  action  can  remove  the  thin  magnetic  layer  on  tape  media,  the  sheer 
length  of  the  tape  in  cartridges  readers  this  approach  impractical  due  to  the  amount  of 
time  and  effort  required  to  accomplish  destruction. 


Destruct  Method:  MECHANICAL  MUTILATION,  abrasive  action 
Storage  Medium:  Magnetic,  Recording,  Floppy  Disks 
Effectiveness:  Medium 

Process: 

Both  surfaces  of  the  magnetic  recording  medium  are  subjected  to  abrasive  action  re¬ 
moving  the  thin,  information  storing  magnetic  recording  layer. 

Destruction  Issues: 

System  Overhead  Concerns 
-  Manpower  requirements 

Personnel  are  needed  to  remove  the  protective  jackets  and  shells  to  access  the  floppy 
disks  themselves.  Personnel  must  manually  perform  the  actual  destruct  function. 


Ride  of  antTtpnrwniim 

-  Destruction  completeness 

Medium  to  high.  The  magnetic  surface  layer  can  be  completely  removed  with  abra¬ 
sives.  Careless  workmanship,  however,  may  leave  patches  of  the  information  stor¬ 
ing  layer  intact 

-  Information  concentration 

Floppy  diskettes  are  compact  and  relatively  portable.  They  do  not  require  any  special 
care  or  handling.  As  such,  they  tend  to  be  distributed  throughout  a  facility:  in  desk 
drawers,  in  files,  etc. 

-  Medium  accessibility 

Floppy  disks  found  at  a  facility  may  contain  both  sensitive  and  routine  information. 
Unless  the  disks  have  security  markings  or  the  contents  are  indexed,  identification 
and  prioritization  of  disks  for  destruction  may  be  difficult  The  medium  is  highly  ac¬ 
cessible  unless  stored  in  secure  containers. 


State  of  Destruct  Technology 

This  is  a  manual  process,  not  requiring  any  elaborate  destruct  equipment 


Discussion: 

Abrasive  action  is  a  crude,  but  effective,  method  of  destroying  information  stored  on 
floppy  disks.  Virtually  any  abrasive,  such  a  sandpaper  or  cleaning  scouring  powder, 
can  be  used.  The  main  drawback  of  this  technique  is  the  time  necessary  to  access  the 
magnetic  diskette  itself  and  to  completely  abrade  both  surfaces.  It  is  conjectured  that 
a  mechanism  that  would  mechanically  abrade  the  surface  of  a  floppy  disk  could  be 
included  as  part  of  a  disk  drive  unit  The  effectiveness  and  advisability  of  this  ap¬ 
proach  requires  further  investigation. 
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Destruct  Method:  MECHANICAL  MUTILATION,  abrasive  action 
Storage  Medium:  Magnetic,  Recording,  Hard  Disks,  Removable 
Effectiveness:  Medium  to  High 

Process: 

Both  surfaces  of  the  magnetic  recording  medium  are  subjected  to  abrasive  action  re¬ 
moving  the  thin,  information  storing,  magnetic  recording  layer. 

Destruction  Issues: 

System  Overhead  Cn nr^rm 


Manpower  requirements 

Personnel  are  needed  to  remove  die  hard  disks  from  any  protective  shell  or  housing. 
Personnel  must  manually  perform  the  actual  destruct  function. 


Risk  of  compromise 
-  Destruction  completeness 

Medium  to  high.  The  magnetic  surface  layer  can  be  completely  removed  with  abra 
sives.  Careless  workmanship,  however,  may  leave  patches  of  the  information  stor¬ 
ing  layer  intact 


-  Information  concentration 

Hard  disks  tend  to  be  stored  in  the  proximity  of  the  associated  disk  drive. 
•  Medium  accessibility 

Medium  is  highly  accessible  unless  stored  in  secure  containers. 


State  of  Destruct  Technology 

This  is  a  manual  process,  not  requiring  any  elaborate  destruct  equipment 


Discussion: 

Abrasive  action  is  a  crude,  but  effective,  method  of  destroying  information  stored  on 
fixed  hard  disks.  Virtually  any  abrasive,  such  a  sandpaper  or  cleaning  scouring 
powder,  can  be  used.  The  main  drawbacks  of  this  technique  are  the  time  and  effort 
necessary  to  access  the  magnetic  disk  itself  and  to  completely  abrade  both  surfaces.  It 
is  conjectured  that  a  mechanism  that  would  mechanically  abrade  the  surface  of  a  hard 
disk  could  be  included  as  part  of  a  disk  drive  unit  The  effectiveness  and  advisability 
of  this  approach  requires  further  investigation. 
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Dcstruct  Method:  MECHANICAL  MUTILATION,  abrasive  action 
Storage  Medium:  Magnetic,  Recording,  Hard  Disks,  Fixed 
Effectiveness:  Medium  to  Poor 

Process: 

Both  surfaces  of  the  magnetic  recording  medium  are  subjected  to  abrasive  action  re¬ 
moving  the  thin,  information  storing,  magnetic  recording  layer. 

Destruction  Issues: 

System  Overhead  Concerns 
-  Manpower  requirements 

Personnel  are  needed  to  access  the  hard  disks  themselves.  Since  fixed  disks  are  usu¬ 
ally  housed  within  hermetically  sealed  chassis,  which  are  further  housed  in  equipment 
racks  and  cabinets,  this  procedure  requires  special  tools  and  training.  Personnel  must 
manually  perform  the  actual  dcstruct  function. 


Safety  Concerns 
-  Process 

Electrical  shock  is  possible  if  information  processing  equipment  is  not  powered  down 
before  personnel  attempt  to  access  memory  elements.  High  voltage  may  be  retained 
by  some  capacitors  even  after  external  power  is  removed. 


Riakofcompromiac 

-  Destruction  completeness 

Medium  to  high.  The  magnetic  surface  layer  can  be  completely  removed  with  abra¬ 
sives.  Careless  workmanship,  however,  may  leave  patches  of  the  information  stor¬ 
ing  layer  intact 


-  Information  concentration 

Fixed  hard  disks  are  mounted  integral  to  the  information  processing  equipment  or 
close  to  it  (they  need  to  be  physically  connected  by  a  cable). 

•  Medium  accessibility 

Medium  is  not  accessible.  The  disk  itself  is  housed  in  a  sealed  container  which  is 
then  usually  further  mounted  within  other  successive,  difficult  to  access,  enclosures. 


State  of  Dcstruct  Technology 

This  is  a  manual  process,  not  requiring  any  elaborate  destruct  equipment 


Discussion: 
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Abrasive  action  is  a  crade  but  effective  method  of  destroying  information  stored  on 
fixed  hard  disks.  Virtually  any  abrasive,  such  a  sandpaper  or  cleaning  scouring 
powder,  can  be  used.  The  main  drawbacks  of  this  technique  are  the  time  and  effort 
necessary  to  access  the  magnetic  disk  itself  and  to  completely  abrade  both  surfaces.  It 
is  conjectured  that  a  mechanism  that  would  mechanically  abrade  the  surface  of  a  hard 
disk  could  be  included  as  part  of  a  disk  drive  unit  The  effectiveness  sad  advisability 
of  this  approach  requires  further  investigation. 
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Destruct  Afetlod:  MECHANICAL  MUTILATION,  abrasive  action 
Storage  Median:  Magnetic,  Recording,  Drums 
Effectiveness:  Medium  to  High 

Process: 

The  thin  magnetic  surface  coating  of  the  drum  is  removed  by  mechanically  abrading 
die  surface. 

Destruction  Issues: 

System  Overhead  Concerns 

-  Manpower  requirements 

Personnel  are  needed  to  access  the  magnetic  drums.  This  procedure  requires  special 
tools  and  training.  Personnel  must  manually  perform  the  actual  destruct  function. 


Safety  Concerns 

-  Process 

Electrical  shock  is  possible  if  information  processing  equipment  is  not  powered  down 
before  personnel  attempt  to  access  the  magnetic  drums.  High  voltage  may  be  retained 
by  some  capacitors  even  after  external  power  is  removed. 


Risk  of  compromise 

-  Destruction  completeness 

Medium  to  high.  The  plated  magnetic  surface  layer  can  be  completely  removed  with 
abrasives.  Careless  workmanship,  however,  may  leave  patches  of  the  information 
storing  layer  intact 

-  Information  concentration 

Magnetic  drums  are  an  old  technology,  and  store  information  at  a  relatively  low  den¬ 
sity.  The  drum  storage  unit  is  usually  an  integral  part  of  the  information  processing 
equipment 

-  Medium  accessibility 

Pom-.  Magnetic  drums  rotate  at  a  high  speed,  and  therefore  are  housed  within  a 
sealed,  protective  enclosure.  Accessibility  is  further  reduced  since  the  enclosed  drum 
is  usually  mounted  within  chassis  and  equipment  racks. 


State  of  Destruct  Technology 

This  is  a  manual  process,  not  requiring  any  elaborate  destruct  equipment 


Discussion: 

Abrasive  action  is  a  crude,  but  effective,  method  of  destroying  information  stored  on 
magnetic  drums.  Virtually  any  abrasive,  such  a  sandpaper  or  cleaning  scouring 
powder,  can  be  used.  The  main  drawback  of  this  technique  is  the  time  necessary  to 
access  the  drum  itself  and  to  completely  abrade  the  surface  of  the  drum. 
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Dcstruct  Method:  MECHANICAL  MUTILATION,  abrasive  action 
Storage  Medium:  Magnetic,  Current- Accessed  (Core,  Twistor,  Plated  Wire) 
Effectiveness:  Notapplicabk/practical 

Discussion: 

There  are  no  memory  components  that  could  be  destroyed  effectively  with  abrasive 
action. 


Destruct  Method:  MECHANICAL  MUTILATION,  abrasive  action 
Storage  Medium:  Magnetic,  Bubble 
Effectiveness:  Not  applicable/practical 

Discussion: 

Although  the  bubble  memory  utilizes  a  dun  surface  layer  of  garnet  on  a  substrate  that 
could  be  destroyed  by  abrasion,  this  active  layer  is  not  readily  accessible  in  order  to 
apply  the  abrasive  action.  The  amount  of  time  that  would  be  required  to  access  and 
disassemble  a  bubble  memory  module  in  order  to  reach  this  active  layer  makes  abra¬ 
sive  action  impractical  Furthermore,  in  the  process  of  disassembly,  once  the  bias 
field  permanent  magnets  are  removed,  the  bubble  domains  collapse,  destroying  any 
stored  information.  As  such,  further  disassembly  to  apply  abrasive  action  is  unnec¬ 
essary. 


1 
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Destruct  Method:  MECHANICAL  MUTILATION,  abrasive  action 
Storage  Medium:  Optical,  Microform 

Effectivenesa:  Medium  to  High  (small  volumes).  Not  applicable/practical  (large 

volumes) 


Process: 

The  emulsion  of  the  microform  film  storage  medium  is  removed  with  abrasive  action. 
Destruction  Issues: 

System  Overhead  Concerns 
-  Manpower  requirements 

Personnel  are  needed  to  remove  tire  microform  media  from  protective  jackets  or  rolls. 
Personnel  must  manually  perform  the  actual  destruct  function. 


Risk  of  compromise 
-  Destruction  completeness 

Medium  to  high.  The  film  emulsion  layer  can  be  completely  removed  with  abrasives. 
Careless  workmanship,  however,  may  leave  patches  of  the  information  storing  layer 
intact 


-  Information  concentration 

Microforms  are  small  and  highly  portable.  Microfilm  on  reels  tends  to  be  housed  in 
protective  boxes  and  stored  in  special  file  cabinets.  Microfiche  are  housed  in  protec¬ 
tive  paper  sleeves  and  are  likewise  frequently  stored  in  cabinets.  Because  they  are  flat 
and  readily  available  in  "user  copies,"  microfiche  tend  to  be  distributed  throughout  a 
facility:  in  desk  drawers,  in  files,  etc. 


State  of  Destruct  Technology 

This  is  a  manual  process,  not  requiring  any  elaborate  destruct  equipment 


Discussion: 

Abrasive  action  is  a  crude,  but  effective,  method  of  destroying  information  stored  on 
microform  media.  Virtually  any  abrasive,  such  a  sandpaper  or  cleaning  scouring 
powder,  can  be  used.  The  main  drawback  of  this  technique  is  the  time  necessary  to 
completely  abrade  the  surface. 
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Destruct  Method:  MECHANICAL  MUTILATION,  abrasive  action 
Storage  Medium:  Optical,  Laser- Accessed 
Effectiveness:  Possibly  Medium  to  High 


Process: 

The  surface  of  the  optical  storing  medium  is  subjected  to  abrasive  action,  removing 
die  thin,  information  storing  layer. 

Destruction  Issues: 


-  Materials 

The  hazards  of  exposure  to  some  of  the  optical  storage  materials  themselves  (e.g., 
tellurium  compounds  and  alloys  in  the  WORM  type  media)  have  not  been  thoroughly 
investigated.  During  normal  medium  use,  these  materials  are  encapsulated,  and  not 
likely  to  contact  personnel.  Abrading  the  medium  surface  may  expose  personnel  to 
these  materials  with  unknown  health  effects. 


•  Destruction  completeness 

Possibly  medium  to  high.  Laser-accessed  optical  storage  media  store  information  in  a 
thin  layer  near  the  surface.  It  is  unknown  how  difficult  it  will  be  to  abrasively  pene¬ 
trate  the  outer  protective  layers  and  to  teach  the  information  storing  layer.  More  re¬ 
search  in  this  area  is  necessary. 

-  Information  concentration 

Individual  media  elements  (e.g.,  discs,  tapes)  can  contain  tremendous  amounts  of  in¬ 
formation  in  a  relatively  small  volume.  The  individual  media  elements  are  highly 
portable  and  rugged.  Thus,  they  can  be  stored  in  any  manner  consistent  with  facility 
security  requirements. 

-  Medium  accessibility 

Medium  is  highly  accessible  unless  stored  in  secure  containers. 

State  of  Destruct  Technology 

This  is  a  manual  process,  not  requiring  any  elaborate  destruct  equipment 


Discussion: 

Laser-accessed  optical  storage  media  are  not,  as  yet,  widely  distributed.  It  can  be  ex¬ 
pected,  however,  that  this  technology  will  experience  rapid  growth  and  shortly  will 
be  in  wide  use.  The  possibility  of  using  abrasive  action  to  destroy  optical  disks 
should  be  investigated  further. 
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Destruct  Method:  MECHANICAL  MUTILATION,  abrasive  action 
Storage  Medium:  Punched,  Cards 
Effectiveness :  Not  applicable/practical 

Discussion: 

Abrasive  action  is  not  an  effective  or  efficient  method  for  rapidly  destroying  the  in¬ 
formation  content  of  paper-based  media. 
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Destruct  Method:  MECHANICAL  MUTILATION,  abrasive  action 
Storage  Medium:  Punched,  Tape 
Effectiveness:  Not  applicable/practical 

Discussion: 

Abrasive  action  is  not  an  effective  or  efficient  method  for  rapidly  destroying  the  in¬ 
formation  content  of  paper-based  madia. 


Destruct  Method:  MECHANICAL  MUTILATION,  abrasive  action 
Storage  Medium:  Paper,  All  Types 
Effectiveness :  Not  applicable/practical 

Discussion: 

Abrasive  action  is  not  an  effective  or  efficient  method  for  rapidly  destroying  the  in¬ 
formation  content  of  paper-based  media. 
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PULPING 

Pulping,  Generic  Description . C-2 
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Magnetic,  Recording,  Hard  Disk,  Fixed  or  Removable . C-6 
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Punched,  Cards . C- 12 

Punched,  Tape . C-13 

Paper,  All  Types . C-14 
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Generic  Description  of  PULPING 


Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  Characteristics 

A  pulping  system  consists  of  a  tank,  water  extractor,  input  feeder  and  pulp  output 
trough.  The  tank  sizes  range  from  24  to  48  inches  in  diameter.  The  peripheral 
equipment  is  approximately  die  same  size  as  the  tank. 

-  Utility  requirements 

Three  phase  electric  power  along  with  input  and  waste  plumbing  connections.  For 
large  volume  applications,  waste  handling  equipment  also  may  be  necessary. 

-  Manpower  requirements 

Personnel  are  required  to  collect  the  media,  transport  them  to  the  destruct  equipment, 
and  feed  them  into  the  device  and  remove  waste. 


Safety  Concerns 

-  Process 

No  significant  hazards. 

-  Materials 

No  significant  hazards. 

-  Accidental  trigger 

Low  possibility  of  accidental  trigger. 

-  Emergency  environment 

Emergency  environment  does  not  present  new  or  exacerbate  existing  hazards 
associated  with  destruction. 


Risk  of  compromise 

-  Destruction  speed 

Pulper  operation  is  designed  for  continuous  input  of  materials  and  the  tank  is  not  self- 
cleaning.  As  such,  if  an  item  is  inserted  into  the  unit,  there  is  no  set  time  in  which  all 
of  the  constituents  of  the  item  would  pass  through.  The  bulk  of  the  item  would  pass 
through  in  less  than  a  minute,  but  it  is  possible  fen*  some  pieces  (large  enough  to 
permit  information  recovery)  to  remain  in  die  main  tank  for  some  time,  or  until  more 
material  is  added  which  would  help  purge  die  tank. 


-  Throughput 

Different-sized  units  can  destroy  a  maximum  of  500  to  2,000  pounds  of  paper 
products  per  hour  (since  DoD  level  of  security  requires  that  the  waste  material  pass 
through  a  finer  screen  than  is  acceptable  for  industrial  sensitive  material,  the 
throughput  is  reduced  and  is  250  to  1,000  pounds  per  hour). 


Premature  termination 

Possible  to  terminate  prematurely  by  cutting  off  die  electricity  to  the  pulper.  If  the 
water  supply  is  cut  off,  the  pulper  can  continue  to  destroy  for  a  limited  timi» 
with  water  that  is  recycled  in  the  process.  The  water  however  "thickens"  as  minute 
particles  that  can  not  be  separated  out  readily  accumulate.  During  normal  operation, 
fresh  water  is  continually  added  at  a  rate  of  about  5  gallons  per  minute  or  more 
(depending  on  the  unit  size),  while  "stagnant"  water  is  removed  at  a  rate  that 
maintains  a  constant  water  level. 


-  Destruction  completeness 

Excellent  The  semi-dry  pulp  is  impossible  to  reconstruct 

-  Detectability 

Pulping  is  not  likely  to  be  detectable  from  the  outside. 


-  Information  concentration 

Paper-based  media  tend  to  be  randomly  distributed  everywhere  throughout  a  facility. 
Some  degree  of  information  concentration  exists  in  the  form  of  file  cabinets,  desks 
and  shelves. 

-  Medium  accessibility 

Readily  accessible  unless  stored  in  secure  containers.  The  major  difficulty  is  not 
getting  to  the  material,  but  rather  separating  the  sensitive  material  from  the  sheer 
volume  of  other  material. 


State  of  Destruct  Technology 

Pulping  has  been  in  use  for  over  25  years.  The  technology  is  mature  and  well- 
developed. 


Discussion: 

Pulping  is  particularly  appropriate  for  the  routine  destruction  of  large  volumes  of 
paper-based  material  requiring  a  sustained  throughput  Pulping  cannot  destroy 
plastics,  metal  and  other  non-paper  materials.  Therefore,  plastic  folders,  binders, 
covers,  etc.  may  interfere  with  the  machine's  operation. 
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Destruct  Method:  PULPING 

Storage  Medium:  Semiconductor,  All  Types 

Effectiveness:  Not  applicable/practical 


Discussion: 

Pulpers  are  inappropriate  for  destroying  semiconductor  memories.  The  destruct 
device  would  have  no  effect  on  the  information  content  of  a  semiconductor  memory, 
and  it  is  likely  that  the  memory  device  would  damage  the  pulper  itself. 
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Destruct  Method:  PULPING 

Storage  Medium:  Magnetic,  Recording,  Tape  or  Floppy  Disk  or  Card 

Effectiveness:  Not  applicable/practical 

Discussion: 

The  Mylar  base  of  magnetic  recording  media  is  neither  water  soluble  nor  does  it 
significantly  soften  in  water.  Therefore,  the  destruct  mechanism  utilized  by  pulpers  is 
not  completely  effective  at  destroying  these  media.  The  impeller  blades  of  the  pulper 
tank  win  inflict  some  damage  to  the  media,  but  the  media  will  be  insufficiently 
damaged  to  preclude  information  reconstruction.  Furthermore,  if  large  pieces  of 
plastic  are  sucked  against  the  sizing  sieve,  they  may  clog  the  water  circulating 
mechanism.  The  metal  and  stiff  plastic  constituents  of  the  media  housing  components 
also  may  damage  the  impeller  blades. 

A  potential  research  payoff  area  is  a  "pulping"  device  that  uses  solvents  that  dissolve 
the  particulate  binder.  The  device  could  be  a  closed  system  with  solvent-solute 
separation  and  recovery  based  on  an  integral  distillation  process.  The  resultant  device 
would  not  be  a  true  pulping  device,  but  would  contain  some  of  the  mechanical  aspects 
erf  pulping  coupled  with  chemical  destruction. 


Deatruct  Method:  PULPING 


Storage  Medium:  Magnetic,  Recording,  Hard  Disk,  Fixed  or  Removable 

Effectiveness:  Not  applicable/practical 

Discussion: 


Puipers  are  inappropriate  for  destroying  hard  disks.  The  hard  metal  disk  substrate 
will  damage  the  impeller  blades  and  the  pulper  will  accomplish  only  minimal 
destruction  of  the  information  stored  on  the  disk. 
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Des tract  Method:  PULPING 

Storage  Medium:  Magnetic,  Recording,  Drams 

Effectiveness:  Notapplicabte/practical 


Des  tract  Method:  PULPING 
Storage  Medium:  Magnetic,  Current-Accessed 
Effectiveness:  Not  applicabk^practical 

Discussion: 

Pulpers  are  inappropriate  for  current-accessed  magnetic  memories.  The  hard  metal 
components  and  wires  will  damage  the  impeller  blades  and  could  jam  the  pulper. 
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Des  tract  Method:  PULPING 
Storage  Medium:  Magnetic,  Bubble 
Effectiveness:  Not  applicaMapractical 

Discussion: 

Pulpen  are  inappropriate  for  destroying  magnetic  bubble  memories.  The  destruct 
device  would  have  not  effect  on  the  information  content  of  a  bubble  memory  unless 
the  impeller  blades  happened  to  separate  the  perpendicular  bias  Held  permanent 
magnets  from  die  device  package.  It  is  more  likely,  however,  that  die  memory  device 
would  damage  the  pulper  itself . 
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Destruct  Method:  PULPING 
Storage  Medium:  Optical,  Microform 
Effectiveness :  Not  applicable/practical 

Discussion: 

The  plastic  base  of  microform  media  is  neither  water  soluble  nor  does  it  significantly 
soften  in  water.  Therefore,  the  destruct  mechanism  utilized  by  pulpers  is  not 
completely  effective  at  destroying  these  media.  The  impeller  blades  of  the  pulper  tank 
will  inflict  some  damage  to  die  media,  but  the  meflia  will  be  insufficiently  damaged  to 
preclude  reconstruction.  Furthermore,  if  large  pieces  of  plastic  are  sucked  against  the 
sizing  sieve,  they  may  clog  the  water  circulating  mechanism.  The  metal  and  stiff 
plastic  constituents  of  microform  reels  and  cartridges  also  may  damage  the  impeller 
blades. 

A  potential  research  payoff  area  is  a  "pulping"  device  that  uses  solvents  that  dissolve 
the  image  retaining  photographic  emulsion.  The  device  could  be  a  closed  system  with 
solvent-solute  separation  and  recovery  based  on  an  integral  distillation  process.  The 
resultant  device  would  not  be  a  true  pulping  device,  but  would  contain  some  of  the 
mechanical  aspects  of  pulping  coupled  with  chemical  destruction. 
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Destruct  Method:  PULPING 
Storage  Medium:  Optical,  Laser- Accessed 
Effectiveness :  Possibly  sot  applicable/practical 

Discussion: 

Pulpers  are  probably  inappropriate  for  destroying  laser-accessed  optical  memories. 
Although  laser-accessed  optical  storage  is  an  evolving  technology  with  no  dominant 
product  type  as  yet,  none  of  the  products  that  already  have  appeared  on  die  market  are 
softened  or  dissolved  by  water.  Furthermore,  the  plastic,  glass  or  metal  substrates 
could  damage  the  pulper  itself. 
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Destruct  Method:  PULPING 
Storage  Medium:  Punched,  Cards 
Effectiveness:  High 

Process: 

Paper  punched  cards  are  fed  into  a  pulping  tank,  where  a  rotating  impeller  with 
integral  cutters  creates  a  vortex,  pulling  the  material  against  the  cutters  and  forcing  the 
resultant  slurry  through  a  perforated  sizing  ring.  The  slurry  is  then  passed  through  an 
extractor  which  removes  excess  water,  discharging  a  semi-dry  pulp  and  recycling  the 
water. 


Destruction  Issues: 

Risk  of  compromise 

-  Throughput 

Different-sized  units  can  destroy  a  maximum  of  500  to  2,000  pounds  of  paper 
products  per  hour  (since  DoD  level  of  security  requires  that  the  waste  material  pass 
through  a  finer  screen  than  is  acceptable  for  industrial  sensitive  material,  the 
throughput  is  reduced  and  is  250  to  1,000  pounds  per  hour). 

-  Destruction  completeness 

Excellent.  The  semi-dry  pulp  is  impossible  to  reconstruct 

-  Information  concentration 

Computer  cards  tend  to  be  stored  in  file  cabinets  designed  for  their  size,  in  cardboard 
boxes  holding  up  to  2,000  cards,  or  in  stacks  simply  bound  with  elastic  bands. 
Although  cards  can  be  located  virtually  anywhere  in  a  facility,  they  tend  to  be  in 
discreet  clusters. 


State  of  Destruct  Technology 

Pulping  has  been  in  use  for  over  25  years.  The  technology  is  mature  and  well- 
developed. 


Discussion: 

The  relative  thickness  (99  pound  paper)  of  the  card  stock  presents  no  problem  to 
pulpers.  Because  computer  cards  are  a  low  storage  density  medium,  the  physical 
volume  of  cards  at  a  facility  may  be  large.  Furthermore,  the  computer  card  is  an 
obsolete  storage  medium  that  is  in  the  process  of  being  phased  out  More  data  is 
necessary  to  establish  the  actual  quantity  of  cards  that  still  can  be  expected  to  be  found 
at  a  facility. 


C-12 


Destruct  Method:  PULPING 

Storage  Medium:  Punched,  Tape 

Effectiveness:  High  (paper) 

Not  applicable/practical  (plastic) 


Process: 

Paper  punched  tape  is  fed  into  a  pulping  tank,  where  a  rotating  impeller  with  integral 
cutters  creates  a  vortex,  pulling  the  material  against  the  cutters  and  forcing  the 
resultant  slurry  through  a  perforated  sizing  ring.  The  slurry  is  then  passed  through  an 
extractor  which  removes  excess  water,  discharging  a  semi-dry  pulp  and  recycling  die 
water. 


Destruction  Issues: 

Risk  of  compromise 


-  Throughput 

Different-sized  units  can  destroy  a  maximum  of  500  to  2,000  pounds  of  paper 
products  per  hour  (since  DoD  level  of  security  requires  that  the  waste  material  pass 
through  a  finer  screen  than  is  acceptable  for  industrial  sensitive  material,  the 
throughput  is  reduced  and  is  250  to  1,000  pounds  per  hour). 

-  Destruction  completeness 

Excellent  The  semi-dry  pulp  is  impossible  to  reconstruct 

-  Information  concentration 

Punched  tapes  tend  to  be  wound  on  reels  up  to  14  inches  in  diameter,  stored  as  coils, 
or  fanfolded  in  containers. 


State  of  Destruct  Technology 

Pulping  has  been  in  use  for  over  25  years.  The  technology  is  mature  and  well- 
developed. 


Discussion: 

Tape  that  is  stored  on  reels  must  be  removed  from  the  reels  before  die  tape  can  be  de¬ 
stroyed.  This,  in  turn,  adds  to  the  destruct  time.  Oiled  tapes  present  no  problem  to 
pulpers.  Plastic  tapes  cannot  be  destroyed  by  pulpers. 
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Destruct  Method:  PULPING 
Storage  Medium:  Paper,  All  Types 
Effectiveness:  High 

Process: 

Paper  media  are  fed  into  a  pulping  tank,  where  a  rotating  impeller  with  integral  cutters 
creates  a  vortex,  pulling  the  material  against  the  cutters  and  forcing  the  resultant  slurry 
through  a  perforated  sizing  ring.  The  slurry  is  then  passed  through  an  extractor 
which  removes  excess  water,  discharging  a  semi-dry  pulp  and  recycling  the  water. 


Destruction  Issues: 

Risk  of  compromise 

-  Throughput 

Different-sized  units  can  destroy  a  maximum  of  500  to  2,000  pounds  of  paper 
products  per  hour  (since  DoD  level  of  security  requires  that  the  waste  material  pass 
through  a  finer  screen  than  is  acceptable  for  industrial  sensitive  material,  the 
throughput  is  reduced  and  is  250  to  1,000  pounds  per  hour). 

-  Destruction  completeness 

Excellent  The  semi-dry  pulp  is  impossible  to  reconstruct 

-  Information  concentration 

Paper  tends  to  be  randomly  distributed  everywhere  throughout  a  facility.  Some 
degree  of  information  concentration  exists  in  the  form  of  file  cabinets  and 
bookshelves. 

-  Medium  accessibility 

Readily  accessible  unless  stored  in  secure  containers.  The  major  difficulty  is  not 
getting  to  the  material,  but  rather  separating  the  sensitive  material  from  the  sheer 
volume  of  other  material. 


State  of  Destruct  Technology 

Pulping  has  been  in  use  for  over  25  years.  The  technology  is  mature  and  well- 
developed. 


Discussion: 

Pulping  is  particularly  appropriate  for  the  routine  destruction  of  large  volumes  of 
material  requiring  a  sustained  throughput  Pulping's  ability  to  destroy  plastics,  metal 
and  other  non-paper  materials  is  limited.  Although  occasional  plastic  materials,  such 
as  folders,  binders,  covers  etc.,  will  not  damage  a  pulper,  these  materials  are  not 
adequately  destroyed,  and  larger  quantities  may  clog  the  sizing  screen. 

A  portable  pulping  mechanism  is  described  in  U.  S.  Patent  3,688,708  •  Transporter 
Case,  granted  September  5, 1972.  The  mechanism  consists  of  a  container  housing 
the  "water  soluble  paper"  documents,  a  pouch  of  water  and  effervescent  tablets. 
Upon  trigger,  the  water  comes  in  contact  with  the  paper,  while  the  tablets  generate 
turbulence  which  breaks  up  the  documents.  The  patent  has  been  assigned  to  the 


C-14 


General  Signal  Corp.,  Rochester,  N.Y.,  and  it  is  unclear  whether  the  product  was 
ever  manufactured. 


SECTION  D 


EXPLOSION 

Explosion,  Generic  Description . J>2 

Semiconductor,  All  Types . D-4 

Magnetic,  Recording . D-6 

Magnetic,  Current-Accessed  (Core,  Twistor,  Plated  Wire) . D-7 

Magnetic,  Bubble . D-8 

Optical,  All  Types . D-9 

Punched,  All  Types . : . D-10 

Paper,  All  Types . . D-l  1 
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Generic  Description  of  EXPLOSION 


Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  Characteristics 

Explosives  can  be  mounted  integral  to  the  information  storing  equipment  A  small 
quantity  of  explosive  can  generate  a  shock  wave  that  can  impart  significant  damage  to 
information  storing  media.  Since  the  shock  wave  can  cause  structural  damage  to  the 
surrounding  facility  or  personnel,  some  method  for  containing  the  physical  force  of 
the  explosion  is  necessary. 

*  Utility  requirements 

Explosions  can  be  initiated  without  any  external  utility  constraints. 

-  Manpower  requirements 

Generally,  explosives  would  be  mounted  integral  to  the  storage  medium  well  in  ad¬ 
vance  of  the  emergency  situation.  As  such,  personnel  are  needed  only  to  arm  the 
detonating  trigger  mechanism  and  initiate  the  explosion.  If  the  explosives  are  not 
integral  to  the  equipment,  personnel  would  be  required  to  access,  emplace  and  deto¬ 
nate  the  explosive  charges.  Significant  expertise  would  be  necessary  on  the  part  of 
these  personnel  to  assure  that  the  explosives  arc  emplaced  in  a  manner  that  would,  in 
fact,  destroy  all  the  media  to  a  degree  that  would  preclude  information  recovery. 


Safety  Concerns 

-  Process 

Improper  use  of  explosives  may  cause  structural  damage  to  the  facility  and/or  injury 
to  the  personnel. 

-  Materials 

Although  they  are  inherently  dangerous,  explosive  materials  can  be  selected  and 
packaged  in  a  manner  that  minimizes  the  hazards  associated  with  using,  transporting 
and  storing  them.  Some  localities  where  platforms  may  operate  expressly  prohibit 
explosive  materials  within  their  jurisdiction. 

-  Accidental  trigger 

Configurations  that  place  the  media  and  explosives  within  the  same  device  and  allow 
detonation  upon  some  trigger  arc  candidates  for  accidental  trigger.  If  the  media  has  to 
be  collected  and  transported  to  a  common  point,  or  if  the  explosives  have  to  be  em¬ 
placed,  then  the  probability  of  accidental  trigger  is  low. 

-  Emergency  environment 

If  the  explosive  material  is  housed  inside  the  equipment,  the  emergency  environment 
should  present  no  increased  hazard.  The  emergency  environment,  however,  may  ex¬ 
acerbate  the  hazards  of  handling  explosives,  or  may  cause  the  operator  not  to  follow 
all  safety  precautions. 
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-  Destruction  speed 

Once  detonation  is  initiated,  destruction  is  instantaneous.  If  explosives  have  to  be 
emplaced  prior  to  detonation,  the  time  necessary  to  achieve  destruction  is  significantly 
increased. 

-  Throughput 

Throughput  depends  on  the  number  of  units  that  must  be  detonated  independently 
within  the  facility.  Generally,  any  number  of  destruct  units  can  be  wired  together  and 
triggered  simultaneously. 

-  Premature  termination 

Once  detonation  is  triggered,  termination  is  not  possible.  Prior  to  detonation,  the 
triggering  mechanism  may  be  disabled. 

-  Destruction  completeness 

Generally  excellent  The  explosives  can  usually  be  configured  so  that  the  medium  is 
completely  destroyed. 

-  Detectability 

If  the  amount  of  explosive  necessary  to  accomplish  destruction  is  low,  and  if  the  ex¬ 
plosion  can  be  contained  within  the  equipment  cabinet,  the  noise  associated  with  de¬ 
struction  can  be  muffled.  Large  quantities  of  explosives,  or  explosives  that  are  not 
contained  within  a  muffling  enclosure,  will  generate  a  shock  wave  that  can  be  felt  and 
heard  outside  the  immediate  vicinity. 

•  Information  concentration 

Media  that  are  appropriate  for  destruction  with  explosives  tend  to  have  a  high  infor¬ 
mation  density  and  be  in  discrete  clusters. 

-  Medium  accessibility 

Media  accessibility  is  not  an  issue  if  the  information  storing  equipment  has  pre¬ 
mounted,  prc- wired  explosive  charges  inside.  Accessibility  becomes  an  issue  if  ex¬ 
plosive  charges  have  to  be  emplaced. 


State  of  Destruct  Technology 

Explosive  destruct  technology  has  been  developed  only  for  limited  applications  and 
situations. 


Destruct  Method:  EXPLOSION 
Storage  Medium:  Semiconductor,  All  Types 
Effectiveness:  High 


Process: 

Explosive  force  is  used  to  break  apart  die  silicon  die  within  the  device  package. 
Destruction  Issues: 

System  Overhead  Concerns 
•  Physical  Characteristics 

Sufficient  explosives  to  destroy  the  appropriate  semiconductor  devices  can  be  mount¬ 
ed  within  the  information  processing  equipment  Some  internal  reinforcement  or 
protective  shielding  of  the  equipment  may  be  necessary  to  prevent  injury  to  personnel 
upon  detonation. 


Risk  of  compromise 

-  Destruction  completeness 

Excellent  The  explosive  mechanism  can  be  designed  so  that  the  semiconductor  die  is 
completely  destroyed. 

-  Detectability 

The  amount  of  explosive  necessary  to  accomplish  destruction  is  low,  and  since  the 
explosion  is  contained  within  the  equipment  cabinet  the  noise  associated  with  de¬ 
struction  is  rather  muffled. 

-  Information  concentration 

The  information  to  be  destroyed  resides  within  device  components  of  electronic 
equipment  that  may  be  dispersed  throughout  a  facility.  If  the  explosives  are  mounted 
within  appropriate  units  so  as  to  destroy  the  proper  component,  die  effect  of  informa¬ 
tion  disposal  is  minimal. 


State  of  Destruct  Technology 

The  technology  for  explosively  destroying  individual  semiconductor  memory 
components,  while  they  are  mounted  within  an  equipment  chassis,  has  been 
demonstrated. 


Discussion: 

The  principal  method  for  explosively  destroying  semiconductor  memory  devices 
consuls  of  mounting  small  quantities  of  explosive  material  on  a  plexiglass  sheet  and 
placing  the  sheet  in  close  proximity  to  the  circuit  board  containing  the  memory  chips 
to  be  destroyed.  The  explosive  charges  are  positioned  on  the  plexiglass  such  that 
they  are  directly  in  line  with  the  chips  to  be  destroyed.  A  small  metal  plate,  about  die 
size  of  a  dime,  is  placed  on  the  plexiglass  between  the  explosive  and  the  semicon¬ 
ductor  chip  and  in  contact  with  the  explosive.  Detonator  wires  connect  the  individual 
explosive  charges  and  terminate  in  a  pair  of  electrical  connectors.  Detonation  can  be 
accomplished  with  either  a  battery  powered  or  a  hand-pumped  detonator.  Upon  det- 
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oaatkn,  the  explosive  "throws”  the  metal  "flying  plate"  into  the  semiconductor  pack¬ 
age,  creating  an  impulse  (of  20  to  40  kilobars)  that  completely  destroys  the  silicon  die 
within  the  package.  This  setup  destroys  both  the  information  stored  on  the  chip  and 
the  technical  information  embodied  in  the  chip  itself.  Provided  there  is  sufficient 
room  within  the  equipment  chassis,  this  type  of  destruct  mechanism  can  be  retrofitted 
into  existing  or  off-the-shelf  equipment 
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Destruct  Method:  EXPLOSION 
Storage  Medium:  Magnetic,  Recoding 
Effectiveness:  Unknown 


Discussion: 

The  effectiveness  of  explosives  at  destroying  magnetic  recording  media  is  unknown. 
In  general,  it  is  conjectured  that  explosives  can  be  used  either  to  blow  apart  a  medium 
(a  form  of  mechanical  mutilation  by  cutting)  or  to  drive  abrasive  particles  against  die 
recording  surface  (a  form  of  mechanical  mutilation  with  abrasives).  Since  magnetic 
recording  media  are  a  rather  high  density  storage  technology,  it  is  unknown  whether 
the  fragments,  after  the  medium  is  blown  apart,  will  be  small  enough  to  prevent  in¬ 
formation  reconstruction.  Likewise,  it  is  unknown  if  die  explosively  driven  abrasive 
action  would  be  sufficiently  thorough  so  that  there  would  be  no  patches  of  undis¬ 
turbed  media  surface  remaining. 
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Destruct  Method:  EXPLOSION 

Storage  Medium:  Magnetic,  Current- Accessed  (Core,  Twister,  Plated  Wire) 
Effectiveness:  Possibly  Medium  to  High 


Process: 

Explosive  force  is  used  to  physically  destroy  the  memory  planes  by  separating,  frag¬ 
menting  and  randomizing  the  individual  components. 

Destruction  Issues: 

Risk  of  compromise 

-  Destruction  completeness 

Medium  to  excellent  Depends  on  degree  to  which  the  individual  memory  strange  lo¬ 
cation  dements  are  separated  from  die  matrix. 

-  Information  concentration 

The  information  to  be  destroyed  resides  within  memory  planes  housed  within  elec¬ 
tronic  equipment  that  may  be  dispersed  throughout  a  facility.  If  the  explosives  are 
mounted  within  appropriate  units  so  as  to  destroy  the  proper  component,  the  effect  of 
equipment  dispersal  is  minimal. 


State  of  Dcstruct  Technology 
Unknown. 


Discussion: 

It  is  conjectured  that  core  and  other  current  addressed  memory  storage  devices  can  be 
effectively  destroyed  by  explosive  charges  housed  within  the  equipment 


Destruct  Method:  EXPLOSION 
Storage  Medium:  Magnetic,  Bubble 
Effectiveness:  High 


Process: 

Explosive  force  is  used  to  break  the  permanent  magnet  providing  the  bias  field  away 
from  the  bubble  memory  module. 

Destruction  Issues: 

System  Overhead  Concerns 
-  Physical  Characteristics 

Sufficient  explosives  to  break  apart  a  bubble  memory  module  can  be  mounted  within 
the  information  processing  equipment  Some  internal  reinforcement  or  protective 
shielding  of  die  equipment  may  be  necessary  to  prevent  injury  to  personnel  upon  det¬ 
onation. 


Risk  of  compromise 
-  Destruction  completeness 

Excellent  The  explosives  can  be  configured  so  that  both  the  bias  field  magnets  are 
separated  from  the  module  and  die  bubble  material  die  itself  is  damaged. 

•  Detectability 

The  amount  of  explosive  necessary  to  accomplish  destruction  is  low,  and  if  the  ex¬ 
plosion  is  contained  within  the  equipment  cabinet  the  noise  associated  with  destruc¬ 
tion  is  rather  muffled. 


Information  concentration 

The  information  to  be  destroyed  resides  within  device  components  of  electronic 
equipment  that  may  be  dispersed  throughout  a  facility.  If  the  explosives  are  mounted 
within  appropriate  units  so  as  to  destroy  the  proper  component,  die  effect  of  informa¬ 
tion  disposal  is  minimal. 


State  of  Destruct  Technology 
Unknown. 


Discussion: 

Explosive  force  can  be  effective  at  separating  the  permanent  magnet  from  the  module 
causing  the  magnetic  domains  to  collapse.  Practically,  however,  there  are  better, 
more  effective  techniques  for  destroying  the  information  content  of  a  bubble  memory 
device,  and  it  is  doubtful  that  explosives  would  be  the  technique  of  choice. 


Destruct  Method:  EXPLOSION 
Storage  Medium:  Optical,  All  Types 
Effectiveness:  Unknown 


Discussion: 

The  effectiveness  of  explosives  at  destroying  optical  storage  media  is  unknown.  In 
general,  it  is  conjectured  that  explosives  can  be  used  either  to  blow  apart  a  medium  (a 
form  of  mechanical  mutilation  by  cutting)  or  to  drive  abrasive  particles  against  the  in¬ 
formation  storing  surface  (a  form  of  mechanical  mutilation  with  abrasives).  Optical 
storage  media,  especially  laser-accessed  media,  are  a  rather  high  density  storage  tech¬ 
nology.  It  is  unknown  whether  the  fragments,  after  the  medium  is  blown  apart,  will 
be  small  enough  to  prevent  information  reconstruction.  Likewise,  it  is  unknown  if 
the  explosively  driven  abrasive  action  would  be  sufficiently  thorough  that  there  would 
be  no  patches  of  undisturbed  media  surface  remaining. 
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Destruct  Method:  EXPLOSION 


Storage  Medium:  Punched,  All  Types 
Effectiveness :  Medium  to  High 

Process; 

Explosive  force  is  used  to  cause  the  media  to  disintegrate. 

Destruction  Issues: 

Risk  of  compromise 

-  Destruction  completeness 

Medium  to  excellent  Depends  on  specific  implementation,  but  complete  destruction 
possible. 

-  Detectability 

If  not  adequately  muffled,  the  explosion  shock  wave  may  be  heard  or  felt  on  the  out¬ 
side. 

-  Information  concentration 

Computer  cards  tend  to  be  stored  in  file  cabinets  designed  for  their  size,  in  cardboard 
boxes  holding  up  to  2,000  cards,  or  in  stacks  simply  bound  with  elastic  bands. 
Although  cards  can  be  located  virtually  anywhere  in  a  facility,  they  tend  to  be  in  dis¬ 
creet  clusters.  Punched  tapes  tend  to  be  wound  on  reels  up  to  14  inches  in  diameter, 
stored  as  coils,  or  fanfolded  in  containers. 

-  Medium  accessibility 

Readily  accessible  unless  stored  in  secure  containers.  The  major  difficulty  is  not  get¬ 
ting  to  the  material  itself,  but  rather,  separating  the  sensitive  material  from  the  sheer 
volume  of  routine  material. 


State  of  Destruct  Technology 

No  devices  specifically  designed  to  destroy  punched  media  have  been  identified. 


Discussion: 

Punched  media  are  a  relatively  low  density  storage  medium.  Therefore,  from  the 
perspective  of  accomplishing  a  high  degree  of  destruction  completeness,  explosive 
force  is  highly  appropriate.  The  main  difficulty,  however,  arises  from  the  volume  of 
punched  media  that  can  be  expected  to  be  found  at  a  facility.  To  destroy  a  large 
quantity  of  media,  a  proportionately  large  quantity  of  explosives  would  be  required. 
This,  in  turn,  increases  the  overall  level  of  danger  associated  with  the  destruct  pro¬ 
cess. 
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Destruct  Method:  EXPLOSION 
Storage  Medium:  Paper,  All  Types 
Effectiveness:  Medium  to  High 


Process: 

Explosive  force  is  used  to  cause  the  media  to  disintegrate. 

Destruction  Issues: 

Risk  of  compromise 

-  Destruction  completeness 

Medium  b>  excellent  Depends  on  specific  implementation,  but  complete  destruction 
possible. 

-  Detectability 

If  not  adequately  muffled,  the  explosion  shock  wave  may  be  heard  or  felt  on  the  out¬ 
side. 

-  Information  concentration 

Paper  tends  to  be  randomly  distributed  everywhere  throughout  a  facility.  Some  de¬ 
gree  of  information  concentration  exists  in  the  form  of  file  cabinets  and  book  shelves. 

-  Medium  accessibility 

Readily  accessible  unless  stored  in  secure  containers.  The  major  difficulty  is  not  get¬ 
ting  to  the  material  itself,  but  rather,  separating  the  sensitive  material  from  the  sheer 
volume  of  routine  material. 


State  of  Destruct  Technology 

Sandia  National  Laboratory  has  actually  designed,  tested  and  fielded  an  explosive- 
based  briefcase  document  carrier  that  allows  the  rapid  destruction  of  paper  in  the 
event  of  an  emergency.  The  device  consists  of  a  lightweight  metal  container,  into 
which  up  to  SO  sheets  of  paper  are  placed.  A  thin  sheet  of  explosive  is  placed  among 
the  sheets  of  paper.  When  the  explosive  is  detonated,  it  drives  the  paper  against  and 
through  a  metal  honeycomb.  In  passing  through  the  honeycomb,  die  paper  is  cut  into 
small  fragments,  which  then  randomize  on  the  other  side  of  the  honeycomb. 

Another  method  is  described  in  U.  S.  Patent  3,732,830  -  Security  Method  and 
Device,  issued  May  15,  1973,  and  assigned  to  the  United  States  (Army).  The 
patented  scheme  consists  of  a  honeycomb  sheet  with  shaped  charge  explosives  in 
each  of  the  thousands  of  tiny  cells.  When  triggered,  the  shaped  charges  dnve  the  lin¬ 
er  material  into  the  paper,  effectively  shredding  it 


Discussion: 

Explosive  force  is  most  appropriate  for  destroying  small  discrete  quantities  of  highly 
sensitive  paper  media.  It  is  not  expected  that  explosive  force  is  appropriate  for  de¬ 
stroying  all  the  sensitive  paper  media  that  could  be  located  at  a  facility. 
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SECTION  E 


CHEMICAL  ACTION 

Chemical  Action,  Generic  Description . E-2 

Semiconductor,  All  Types . E-4 

Magnetic,  Recording,  Tape,  Reel-to-Reel . E-5 

Magnetic,  Recording,  Tape,  Cartridges  (Cassettes,  Wafers) . E-7 

Magnetic,  Recording,  Floppy  Disks . E-9 

Magnetic,  Recording,  Hard  Disks,  Removable . E-10 

Magnetic,  Recording,  Hard  Disks,  Fixed . E-ll 

Magnetic,  Recording,  Dram.... . E-13 

Magnetic,  Current-Accessed  (Core,  Twistor,  Plated  Wire) . E-15 

Magnetic,  Bubble . E-16 

Optical,  Microform . E-17 

Optical,  Laser-Accessed . E-18 

Punched,  Cards . E-19 

Punched,  Tape . .'. . E-21 

Paper,  All  Types . E-23 


Generic  Description  of  CHEMICAL  ACTION 


Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  Characteristics 

The  equipment  allowing  the  use  chemicals  for  destroying  information  media  varies  by 
media  type.  Generally,  the  media  can  be  placed  into  a  container  with  the  appropriate 
chemicals,  or  die  chemicals  can  somehow  be  dispensed  directly  onto  the  media.  The 
former  approach  requires  some  type  of  vat  that  is  resistant  to  the  chemicals  and  a 
method  for  storing  the  chemicals.  The  latter  may  utilize  some  permutation  of  piping, 
pumping,  or  other  method  for  delivering  the  chemicals  to  the  medium.  The  chemicals 
must  be  stored  and,  if  they  have  a  limited  shelf  life,  replaced  as  necessary. 

-  Utility  requirements 

Many  of  the  chemicals  that  can  be  used  to  destroy  media  emit  noxious  or  dangerous 
fumes.  As  such,  some  form  of  forced  ventilation  may  be  necessary. 

-  Manpower  requirements 

If  media  are  to  be  placed  into  a  vat  filled  with  the  appropriate  chemicals,  then  person¬ 
nel  are  needed  to  access,  remove,  collect,  transport  and  place  die  media  into  the  con¬ 
tainer.  The  proper  chemicals  will  have  to  be  identified,  transported  and  poured  into 
the  vat  Specific  information  storage  media  configurations  may  affect  how  this  task 
can  be  performed.  In  systems  that  dispense  the  chemicals  onto  the  media,  personnel 
may  have  to  load  the  chemicals  into  a  central  dispenser  and  then  trigger  the  delivery 
mechanism. 


Safctt-Conccma 

-  Process 

Destruction  by  chemical  action  may  be  quite  hazardous.  Some  of  the  materials  that 
can  be  used  in  destruction  are  themselves  hazardous;  likewise,  in  the  process  of  de¬ 
struction,  the  associated  chemical  reactions  may  result  in  dangerous  by-products. 
Possible  hazards  include  toxic  fumes,  personnel  contact  hazards,  and  explosive  con¬ 
stituents. 

-  Materials 

Numerous  hazardous  materials  are  good  candidates  for  accomplishing  destruction. 
Mineral  acids  can  cause  severe  bums  if  allowed  to  contact  skin,  can  result  in  blind¬ 
ness  if  allowed  to  contact  eyes,  and  can  damage  the  mucous  membranes  of  the  lungs 
and  nasal  passages  if  their  fumes  are  inhaled.  Inhalation  of  organic  solvent  vapors 
can  cause  headaches,  dizziness  and  even  the  loss  of  consciousness.  Long  term 
exposure  to  solvents,  such  as  could  be  encountered  in  repeated  drills  or  training 
sessions,  can  cause  liver  damage  and  some  forms  of  cancer.  The  solvents  are  fre¬ 
quently  highly  flammable,  and  the  accumulation  of  vapors  may  lead  to  an  explosion. 
Tetra  hydro  furan,  a  potential  candidate  for  dissolving  magnetic  recording  media 
binders,  forms  unstable  explosive  peroxides  if  stored  for  a  long  time. 
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-  Accidental  trigger 

Configurations  that  place  the  media  and  chemicals  within  the  same  device  and  allow 
die  two  to  mix  upon  some  trigger  axe  candidates  for  accidental  trigger. 

-  Emergency  environment 

The  emergency  environment  seriously  exacerbates  the  hazards  associated  with 
chemical  action  destruction.  Many  or  the  possible  destruct  materials  are  highly 
flammable,  and  can  explode  if  open  flames  or  gunfire  is  present  Furthermore,  the 
speed  required  during  emergency  destruction  may  cause  personnel  to  spill  or  other¬ 
wise  come  in  contact  with  dangerous  chemicals. 


Risk  of  enmnromiie 

-  Destruction  speed 

Highly  variable.  The  destruction  speed  depends  on  the  specific  medium-chemical 
combination,  the  configuration  of  the  media  (e.g.,  whether  it  is  tightly  rolled  or  flat), 
the  relative  concentration  of  the  chemicals,  their  temperature  and  the  degree  of  agita¬ 
tion. 

-  Throughput 

Throughput  can  be  partitioned  into  two  elements:  die  efficiency  of  getting  the  chemi¬ 
cals  in  contact  with  die  media  and  die  effectiveness  of  the  chemical  action.  The  speed 
with  which  die  chemicals  can  be  brought  in  contact  with  die  appropriate  materials  de¬ 
pends  on  the  specific  chemical  dispensing  method  or  the  method  of  getting  the  media 
to  the  chemicals.  The  effectiveness  of  the  chemical  action  is  medium-chemical  com¬ 
bination  specific. 

-  Premature  termination 

It  is  possible  to  terminate  chemical  action  by  diluting  the  chemical  or  neutralizing  its 
-  effectiveness  (e.g.,  neutralizing  an  acid  with  a  base). 

-  Destruction  completeness 

Depends  on  specific  chemical-medium  factors. 

-  Detectability 

Chemical  action  may  produce  odors  or  fumes  that  could  be  detected  from  outside  the 
immediate  vicinity  of  the  destruct  effort 

-  Information  concentration 

Depends  on  specific  medium-facility  factors.  Information  frequently  will  be  concen¬ 
trated  in  file  cabinets  or  bookcases.  Since  information  is  rarely  cataloged  and  stored 
by  sensitivity  category  alone,  a  major  task  may  be  die  identification  and  separation  of 
highly  sensitive  information  from  less  sensitive  material. 

-  Medium  accessibility 

Depends  on  specific  medium-facility -equipment  factors.  The  difficulty  and  complex¬ 
ity  of  accessing  media  is  set,  in  part,  by  die  specific  medium  and  whether  it  was  de¬ 
signed  to  be  fixed  or  removable.  The  removal  of  fixed  media  may  be  relatively  com¬ 
plex  and  may  require  special  tools  and  training.  Both  fixed  and  removable  media  may 
be  stored  in  secure  containers  or  housings,  which  in  turn  may  delay  accessing  the 
actual  media.  In  situations  where  a  chemical  dispensing  mechanism  is  built  integral  to 
die  equipment,  accessibility  is  not  a  major  factor. 
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Stale  of  Destruct  Technology 

There  are  very  few  products  that  employ  chemical  action  to  destroy  media.  This  area 
presents  opportunities  for  research. 

Destruct  Method:  CHEMICAL  ACTION 

Storage  Medium:  Semiconductor,  All  Types 

Effectiveness:  Not  applicable/practical 


Discussion: 

There  are  two  aspects  to  the  chemical  destruction  of  semiconductor  memories:  pene¬ 
trating  the  device  package  housing  the  actual  memory  die,  and  destroying  die  semi¬ 
conductor  memory  element  itself.  Semiconductor  memory  elements  are  supplied  in  a 
wide  variety  of  packages,  both  in  terms  of  physical  configuration  and  material  com¬ 
position.  There  exists  no  universal  chemical  that  can  rapidly  attack  and  destroy  all  the 
possible  varieties  of  semiconductor  packaging  materials.  The  organic  solvents  that 
possibly  can  dissolve  some  of  the  common  plastic  package  types,  have  no  effect  on 
the  semiconductor  die.  Furthermore,  die  processed  silicon  die  itself  is  resistant  to 
most  chemicals  except  for  the  strongest  acids,  such  as  hydrofluoric  acid.  Hydrofluo¬ 
ric  acid  can  destroy  a  silicon  die,  but  has  no  effect  on  most  plastic  materials.  Hy¬ 
drofluoric  acid  is  also  extremely  hazardous,  and  contact  with  skin  may  result  in  per¬ 
manent  skin  ulcers.  As  a  final  note,  if  a  two-step  process  is  used,  a  thin  plastic 
residue  coating  left  by  die  dissolved  package  could  actually  have  the  effect  of  pro¬ 
tecting  the  die  from  subsequent  attack  by  die  acid. 


Destruct  Method:  CHEMICAL  ACTION 
Storage  Medium:  Magnetic,  Recording,  Tape,  Reel-to-Reel 
Effectiveness :  Possibly  Medium  to  High 

Process: 

The  tape  is  subjected  to  chemicals  that  dissolve  die  Mylar  substrate  or  particle  binder. 
Destruction  Issues: 

System  Overhead  Concerns 


Manpower  requirements 

Personnel  axe  required  to  collect  the  media,  transport  them  to  the  destruct  equipment, 
separate  the  tapes  from  the  reels,  and  place  them  into  die  container.  In  addition,  the 
chemicals  must  be  poured  or  otherwise  brought  into  contact  with  the  media,  and  the 
mixture  agitated  to  assist  the  chemical  action. 


Risk  of  compromise 

-  Destruction  completeness 

Excellent,  provided  the  chemicals  are  able  to  contact  the  tape  surface.  If  the  tape  is 
left  wound  on  reels,  the  chemicals  may  fail  to  reach  the  actual  media  surfaces.  Re¬ 
moving  the  tape  from  die  reels  enhances  die  destruct  process. 

-  Information  concentration 

Tapes  are  frequently  stored  on  racks  in  tape  libraries.  They  also  can  be  distributed 
throughout  a  facility:  in  desk  drawers,  in  me  cabinets,  etc. 

-  Medium  accessibility 

Tapes  found  at  a  facility  may  contain  both  sensitive  and  routine  information.  Unless 
die  reels  have  security  markings  or  the  contents  are  indexed,  identification  and  priori¬ 
tization  of  tapes  for  destruction  may  be  difficult  The  medium  is  highly  accessible 
unless  stored  in  secure  containers. 


State  of  Destruct  Technology 

No  existing  systems  were  identified,  but  it  should  be  possible  to  implement  the  tech¬ 
nology  after  some  initial  research  to  identify  the  most  appropriate  chemicals  and  dis¬ 
pensing  system  configurations. 


Discussion: 

Organic  chemicals,  such  as  tetra  hydro  furan  (THF)  ot  dimethyl  sulfoxide  (DMSO), 
are  most  appropriate  candidates  for  tape  destruction.  Such  chemicals  may  attack  the 
organic  binder  holding  the  ferrite  particles  to  the  Mylar.  The  exact  chemical 
combination  that  is  effective  at  attacking  the  binder  depends  on  the  specific  propri¬ 
etary  binder  formulation  used  by  a  manufacturer.  Due  to  such  binder  variations, 
some  chemicals  may  successfully  attack  the  binder  of  one  brand  of  media,  yet  leave 
another  brand  intact  Some  manufacturers  are  reportedly  using  electron  beam  curing 
of  the  binder,  which  leaves  the  medium  more  resistant  to  chemical  attack.  Although 
mineral  acids,  such  as  hydrochloric  acid  or  nitric  acid,  may  cause  the  Mylar  to  swell 


slightly  or  may  corrode  the  ferrite  particles,  it  is  unknown  if  such  damage  is  sufficient 
to  preclude  information  recovery.  Mylar  it  a  very  stable  and  chemically  resistant 
polyester.  No  chemicals  that  rapidly  attack  Mylar  woe  identified. 

A  tape  cutter  consisting  of  an  arbor-type  press  with  a  cutting  blade  and  a  hub  for 
mounting  the  reel  of  tape  has  been  developed  at  the  NSA.  The  reel  is  mounted  on  the 
hub  and  the  arbor  handle  is  pulled  bringing  down  die  blade.  The  blade  cuts  across 
the  width  of  the  tape  causing  it  to  Call  offthe  reel  in  short  lengths. 
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Dcstruct  Method:  CHEMICAL  ACTION 

Storage  Medium:  Magnetic,  Recording,  Tape,  Cartridges  (Cassettes,  Wafers) 

Effectiveness:  Possibly  Medium  to  High 

Process: 

The  magnetic  recording  medium  within  the  cartridge  or  cassette  is  subjected  to 
chemicals  that  dissolve  me  Mylar  substrate  or  particle  binder. 

Destruction  Issues: 

System  Overhead  Concerns 
-  Manpower  requirements 

The  tape  within  a  cartridge  or  cassette  may  need  to  be  unwound,  or  the  housing  bro¬ 
ken  open.  In  addition,  the  chemicals  must  be  poured  or  otherwise  brought  into  con¬ 
tact  with  the  media,  and  the  mixture  agitated  to  assist  the  chemical  action. 


Risk  of  compromise 

-  Destruction  completeness 

Expected  to  be  medium  to  high.  The  active  recording  layer  is  very  thin  and,  there¬ 
fore,  the  material  can  be  dissolved  rapidly.  Destruction  speed  is  affected  by  the 
chemicals'  ability  to  access  die  tape  surface  itself.  Cartridge  and  cassette  housings 
can  delay  the  chemicals  in  reaching  the  medium.  Furthermore,  once  the  chemical 
penetrates  the  housing,  it  still  must  reach  the  tape  surface  to  attack  the  information 
storing  surface  areas.  Since  the  tapes  are  tightly  wound  within  the  housing,  the 
chemicals  may  be  prevented  from  reaching  die  information  storing  medium  surface. 

-  Information  concentration 

Cartridges  can  be  distributed  throughout  a  facility:  in  desk  drawers,  in  files,  etc. 

-  Medium  accessibility 

Cartridges  found  at  a  facility  may  contain  both  sensitive  and  routine  information. 
Unless  tire  containers  have  security  markings  or  the  contents  are  indexed,  identifica¬ 
tion  and  prioritization  of  cartridges  for  destruction  may  be  difficult  The  medium  is 
highly  accessible  unless  stored  in  secure  containers. 


State  of  Dcstruct  Technology 

No  existing  systems  were  identified,  but  it  should  be  possible  to  implement  the  tech¬ 
nology  after  some  initial  research  to  identify  the  most  appropriate  chemicals  and 
methods  for  dispensing  them. 


Discussion: 

Organic  chemicals,  such  as  tetra  hydro  furan  (THF)  or  dimethyl  sulfoxide  (DMSO), 
are  most  appropriate  candidates  for  tape  destruction.  Such  chemicals  may  attack  the 
organic  binder  holding  the  ferrite  particles  to  the  Mylar.  The  exact  chemical 
combination  that  is  effective  at  attacking  tire  binder  depends  on  the  specific  propri¬ 
etary  binder  formulation  used  by  a  manufacturer.  Due  to  such  binder  variations, 
some  chemicals  may  successfully  attack  the  binder  of  (me  brand  of  media,  yet  leave 
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another  brand  intact  Some  manufacturer!  are  reportedly  using  electron  beam  curing 
of  the  binder,  which  leaves  the  medium  more  resistant  to  chemical  attack.  Although 
mineral  acids,  such  as  hydrochloric  add  or  nitric  add,  may  cause  die  Mylar  to  swell 
slightly  or  may  corrode  the  ferrite  particles,  it  is  unknown  if  such  damage  is  sufficient 
to  preclude  information  recovery.  Mylar  is  a  very  stable  and  chemically  resistant 
polyester.  No  chemicals  that  rapidly  attack  Mylar  were  identified. 

The  wide  variety  of  tape  cartridge  case  designs  (standards  merely  specify  form,  fit 
function,  and  not  the  exact  cartridge  configuration)  and  formats  means  that  a  universal 
tool  for  rapidly  separating  the  tape  from  the  cartridge  may  be  difficult  to  design.  Such 
a  tod,  however,  would  significantly  simplify  destruction  by  chemical  and  other 
means,  and  therefore,  represents  a  potential  high-payoff  research  area. 


Dcstrad  Method:  CHEMICAL  ACTIOS 
Storage  Medium:  Magnetic,  Recording,  Floppy  Disks 
Effectiveness:  Possibly  High 

Process: 

The  floppy  disk  is  subjected  to  chemicals  that  dissolve  the  Mylar  substrate  or  particle 
binder,  thereby  destroying  the  information  content 

Destruction  Issues: 


Rialr  nf  enmoromise 


-  Destruction  speed 

Expected  to  be  high.  The  record  layer  is  very  thin  and  therefore  can  be  dissolved 
quickly.  The  major  factors  in  destruction  speed  are  the  protective  jackets  and  sleeves. 
They  can  delay  the  solvent  in  teaching  die  medium  itself. 


•  Destruction  completeness 

Expected  to  be  excellent  The  only  concerns  are  die  protective  jackets  and  sleeves  that 
may  prevent  die  solvent  from  reaching  the  medium. 

-  Information  concentration 

Floppy  diskettes  are  inexpensive,  compact  and  relatively  portable.  They  do  not  re¬ 
quire  any  special  care  or  handling.  As  such,  they  tend  to  be  present  in  large  quantities 
and  distributed  throughout  a  facility:  in  desk  drawers,  in  files,  etc.  However,  they 
are  generally  found  in  the  proximity  of  die  disk  drive  units. 

-  Medium  accessibility 

Floppy  disks  found  at  a  facility  may  contain  both  sensitive  and  routine  information. 
Unless  die  the  diskettes  have  security  markings,  or  die  contents  are  indexed,  identifi¬ 
cation  and  prioritization  of  diskettes  for  destruction  may  be  difficult  The  medium  is 
highly  accessible  unless  stored  in  secure  containers. 


State  of  Destruct  Technology 

No  existing  systems  were  identified,  but  it  should  be  possible  to  implement  the  tech¬ 
nology  after  some  initial  research  to  identify  the  most  appropriate  chemicals  and  dis¬ 
pensing  system  configurations. 


Discussion: 

Organic  chemicals,  such  as  tetra  hydro  furan  (THF)  or  dimethyl  sulfoxide  (DMSO), 
are  most  appropriate  candidates  for  floppy  disk  destruction.  Such  chemicals  may  at¬ 
tack  the  organic  binder  holding  the  femte  particles  to  the  Mylar.  The  exact  chemical 
combination  that  is  effective  at  attacking  the  binder  depends  cm  the  specific  propri¬ 
etary  binder  formulation  used  by  a  manufacturer.  Due  to  such  binder  variations, 
some  chemicals  may  successfully  attack  the  binder  of  one  brand  of  media,  yet  leave 
another  brand  intact  Some  manufacturers  are  reportedly  using  electron  beam  curing 
of  the  binder,  which  leaves  the  medium  more  resistant  to  chemical  attack.  Although 
mineral  acids,  such  as  hydrochloric  acid  or  nitric  acid,  may  cause  the  Mylar  to  swell 
slightly  or  may  corrode  the  ferrite  particles,  it  is  unknown  if  such  damage  is  sufficient 
to  preclude  information  recovery.  Mylar  is  a  very  stable  and  chemically  resistant 
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polyester.  No  chemicals  that  rapidly  attack  Mylar  were  identified. 

Dcstruct  Method:  CHEMICAL  ACTION 

Storage  Medium:  Magnetic,  Recording,  Hard  Disk,  Removable 

Effectiveness:  Possibly  Medium  to  High 

Process: 

The  disk  is  subjected  to  substances  that  either  chemically  react  with  the  aluminum 
substrate,  and  the  plated  magnetic  surface  layer,  or  dissolve  the  magnetic  particle 
binder. 

Destruction  Issues: 

Risk  of  compromise 

-  Destruction  conqrieteness 

Expected  to  be  excellent.  Some  disk  media  may  have  a  very  thin  protective  surface 
layer  that  may  determine  the  specific  chemical  combinations  that  would  be  effective. 

-  Information  concentration 

Removable  hard  disks  tend  to  be  stored  in  close  proximity  to  the  disk  drive.  Due  to 
their  relatively  high  storage  capacity  and  cost,  there  usually  are  not  that  many  hard 
disks  at  a  facility. 

-  Medium  accessibility 

Some  cartridge  designs  may  limit  the  accessibility  of  the  actual  disk  medium. 

State  of  Dcstruct  Technology 

No  existing  systems  were  identified,  but  it  is  likely  that  the  technology  can  be  imple¬ 
mented  following  some  research  into  optimal  chemical  combinations. 

Discussion: 

There  are  two  major  types  of  fixed  hard  disk  media:  particulate  layer  and  plated  layer. 
The  particulate  layer  consists  of  ferrite  particles  held  onto  the  disk  surface  with  an  or¬ 
ganic  binder.  Plated  disks  consist  of  a  very  thin  layer  of  magnetic  metal  that  has  bom 
electroplated  onto  a  metal  substrate. 

The  chemicals  that  would  be  appropriate  for  hard  disk  destruction  depend  on  the  disk 
type  and  the  aspect  of  die  medium  to  be  affected.  Organic  solvents,  such  as  tetra  hy¬ 
dro  furan  or  dimethyl  sulfoxide,  may  dissolve  die  organic  binder  holding  the  ferrite 
particles  to  the  platter.  The  exact  chemical  combination  that  is  effective  at  attacking 
the  binder  depends  on  the  specific  proprietary  binder  formulation  used  by  a  manu¬ 
facturer.  Due  to  such  binder  variations,  some  chemicals  may  successfully  attack  the 
binder  of  one  manufacturer's  medium,  yet  leave  another  manufacturer's  medium  in¬ 
tact  Mineral  acids,  such  as  sulfuric,  hydrochloric  or  nitric  acid,  react  with  aluminum 
-  the  most  common  metal  substrate  -  and  with  the  metal  constituents  of  plated  layers. 
Mineral  acids  do  not  affect  most  plastics  or  the  organic  binder  materials.  More  exotic 
acids,  such  as  trifluoro  acetic  acid,  affect  both  metals  and  plastics,  but  their  specific 
effect  on  binder  formulations  is  unknown. 
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I  Dcstruct  Method:  CHEMICAL  ACTION 

Storage  Medium:  Magnetic,  Recording,  Hard  Disk,  Fixed 
!  Effectiveness:  Possibly  Medium  to  High 

Process: 

The  is  subjected  to  substances  that  chemically  react  with  the  aluminum  substrate, 
the  plated  magnetic  surface  layer,  or  dissolve  the  magnetic  particle  binder. 

I  Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  Characteristics 

Most  likely,  the  chemicals  would  be  placed  integral  to  the  disk  drive  unit  Alterna¬ 
tively,  the  chemicals  could  be  stored  at  one  location  and  in  an  emergency  brought  to 
the  media  either  by  personnel  or  via  a  network  of  pipes,  valves  and  pumps. 

-  Manpower  requirements 

Personnel  may  be  required  to  identify  the  appropriate  disk  drive  unit  and  trigger  the 
destruct  mechanism,  or  alternatively,  to  transport  the  chemicals  to  the  storage  device 
manually  or  via  a  piping  mechanism. 


Safety  Concerns 


-  Accidental  trigger 

Depends  on  the  specific  implementation.  If  the  destruct  mechanism  is  mounted  inte¬ 
gral  to  the  disk  drive  unit,  accidental  trigger  is  possible.  If  the  chemicals  are  brought 
to  the  disk  drive  unit  and  in  some  manner  dispensed  to  bring  the  storage  medium  in 
contact  with  die  chemicals,  the  possibility  of  accidental  trigger  is  much  lower. 


Risk  of  compromise 
-  Destruction  speed 

Expected  to  be  high.  The  particulate  oxide  recording  layer  is  very  thin  and  the  entire 
binder  can  be  dissolved  very  rapidly.  Likewise,  on  plated  media,  the  magnetic 
recording  layer  is  very  thin  and  can  be  eaten  away  rapidly  by  acids.  Aluminum  reacts 
very  strongly  with  acids. 


-  Throughput 

Destruction  could  be  accomplished  on  a  disk  drive  by  disk  drive  basis,  or  alterna¬ 
tively,  on  all  disk  drives  simultaneously  in  response  to  a  central  trigger.  If  the  de¬ 
struct  system  is  well  designed  and  allows  the  personnel  to  get  the  chemical  in  contact 
with  the  medium  rapidly,  throughput  is  simply  limited  by  personnel's  ability  to  trig¬ 
ger  the  destruct  mecnamsm. 

-  Destruction  completeness 

Expected  to  be  excellent,  provided  the  chemical  is  able  to  contact  the  disk  surfaces. 
Some  disk  media  may  have  a  very  thin  protective  surface  layer  that  may  determine  the 
appropriate  choice  of  chemicals. 
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-  Information  concentration 

Fixed  hard  disks  are  mounted  integral  to  the  information  processing  equipment  or 
close  to  it  (they  need  to  be  physically  connected  by  a  cable). 

-  Medium  accessibility 

Medium  is  not  accessible.  The  disk  itself  is  housed  in  a  sealed  container  which  is 
then  usually  further  mounted  within  other  successive,  difficult  to  access,  enclosures. 


State  of  Destruct  Technology 

No  existing  systems  were  identified,  but  it  should  be  possible  to  implement  the  tech 
nology  after  some  initial  research  to  identify  the  most  appropriate  chemicals  and  dis 
pensing  system  configurations. 


Discussion: 

There  are  two  major  types  of  fixed  hard  disk  media:  particulate  layer  and  plated  layer. 
The  particulate  layer  consists  of  ferrite  particles  held  onto  the  disk  surface  with  an  or¬ 
ganic  binder.  Plated  disks  consist  of  a  very  thin  layer  of  magnetic  metal  that  has  been 
electroplated  onto  a  rigid  substrate. 

The  chemicals  that  would  be  appropriate  for  hard  disk  destruction  depend  on  the  disk 
type  and  the  aspect  of  die  medium  to  be  affected.  Organic  solvents,  such  as  tetra  hy¬ 
dro  furan  or  dimethyl  sulfoxide,  may  dissolve  the  organic  binder  holding  the  ferrite 
particles  to  the  platter.  The  exact  chemical  combination  that  is  effective  at  attacking 
the  binder  depends  on  the  specific  proprietary  binder  formulation  used  by  a  manu¬ 
facturer.  Due  to  such  binder  variations,  some  chemicals  may  successfully  attack  the 
binder  of  one  manufacturer's  medium,  yet  leave  another  manufacturer's  medium  in¬ 
tact  Mineral  acids,  such  as  sulfuric,  hydrochloric  or  nitric  acid,  react  with  aluminum 
-  the  most  common  rigid  substrate  -  and  with  the  metal  constituents  of  plated  layers. 
Mineral  acids  do  not  affect  most  plastics  or  the  organic  binder  materials.  More  exotic 
acids,  such  as  trifluoro  acetic  acid,  affect  both  metals  and  plastics. 

Fixed  hard  disks  are  not  readily  user-accessible.  As  such,  the  time  that  would  be  re¬ 
quired  to  access  the  medium  in  order  to  place  it  into  some  container  of  chemicals  for 
destruction  makes  the  removal  of  the  disk  media  impractical  for  emergency  destruc¬ 
tion.  Therefore,  any  chemical  destruction  mechanism  for  fixed  hard  disks  would 
have  to  have  a  mechanism  for  dispensing  the  chemical  directly  into  the  disk  drive  and 
would  have  to  be  externally  triggerable. 
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Destruct  Method:  CHEMICAL  ACTION 
Storage  Medium:  Magnetic,  Recording,  Drum 
Effectiveness :  Possibly  Medium  to  High 

Process: 

The  drum  is  subjected  to  substances  that  chemically  react  with  the  plated  magnetic 
surface  layer  and/or  dissolve  the  magnetic  particle  binder. 

Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  Characteristics 

Most  likely,  the  chemicals  would  be  placed  integral  to  the  drum  drive  unit  Alterna¬ 
tively,  the  chemicals  could  be  stored  at  one  ’  nation  and  in  an  emergency  brought  to 
die  media  either  by  personnel  ex'  via  a  network  of  pipes,  valves  and  pumps. 

-  Manpower  requirements 

Personnel  may  be  required  to  identify  the  appropriate  drive  unit  and  trigger  the  de¬ 
struct  mechanism,  or  alternatively,  to  transport  the  chemicals  to  the  storage  device 
manually  or  via  a  piping  mechanism. 


Safety  Concerns 
•  Accidental  trigger 

Depends  on  the  specific  implementation.  If  the  destruct  mechanism  is  mounted  inte¬ 
gral  to  die  drive  unit,  accidental  trigger  is  possible.  If  the  chemicals  are  brought  to  the 
drive  unit  and  in  some  manner  dispensed  to  bring  the  storage  medium  in  contact  with 
the  chemicals,  the  possibility  of  accidental  trigger  is  much  lower. 


Risk  of  compromise 

-  Destruction  speed 

Expected  to  be  high.  The  particulate  oxide  recording  layer  is  very  thin  and  the  entire 
binder  can  be  dissolved  very  rapidly.  Likewise,  on  plated  drums,  the  magnetic 
recording  layer  is  very  thin  and  can  be  eaten  away  rapidly  by  acids. 

-  Destruction  completeness 

Expected  to  be  excellent,  provided  the  chemical  is  maintained  in  contact  with  the  drum 
surface. 

-  Information  concentration 

Magnetic  drums  are  mounted  either  integral  to  the  information  processing  equipment 
or  very  close  to  it  (they  need  to  be  physically  connected  by  a  cable). 


State  of  Destruct  Technology 

No  existing  destruct  devices  using  this  process  were  identified. 
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Discussion: 

There  are  two  major  types  of  drum  surfaces:  particulate  layer  and  plated  layer.  The 
particulate  layer  consists  of  ferrite  particles  held  onto  the  drum  surface  with  an  or¬ 
ganic  binder.  Plated  drums  consist  of  a  very  thin  layer  of  magnetic  metal  that  has 
been  electroplated  onto  a  cylindrical  substrate; 

The  chemicals  that  would  be  appropriate  for  drum  destruction  depend  on  the  disk  type 
and  the  aspect  of  the  medium  to  be  affected.  Organic  solvents,  such  as  tetra  hydro 
furan  or  dimethyl  sulfoxide,  may  dissolve  die  organic  binder  holding  the  ferrite  par¬ 
ticles  to  die  drum.  The  exact  chemical  combination  that  is  effective  at  attacking  the 
binder  depends  on  the  specific  proprietary  binder  formulation  used  by  a  manu¬ 
facturer.  Due  to  such  binds  variations,  some  chemicals  may  successfully  attack  the 
binder  of  one  manufacturer’s  medium,  yet  leave  another  manufacturer's  medium  in¬ 
tact  Mineral  acids,  such  as  sulfuric,  hydrochloric  or  nitric  acid,  react  with  drum 
substrates  and  with  the  metal  constituents  of  plated  layers.  Mineral  acids  do  not  affect 
plastics  or  the  organic  binder  materials.  More  exotic  acids,  such  as  trifluoro  acetic 
acid,  affect  both  metals  and  plastics. 

Magnetic  drums  are  not  readily  user-accessible.  As  such,  the  time  that  would  be  re¬ 
quired  to  access  the  medium  in  order  to  place  it  into  some  container  of  chemicals  for 
destruction  makes  removal  of  the  drum  media  impractical  for  emergency  destruction. 
Therefore,  any  chemical  destruction  mechanism  for  magnetic  drums  would  have  to 
have  a  mechanism  for  dispensing  the  chemical  directly  into  the  drum  unit  and  would 
have  to  be  externally  triggerable. 
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Destruct  Method:  CHEMICAL  ACTION 

Storage  Medium:  Magnetic,  Current-Accessed  (Core,  Twister,  Plated  Wire) 
Effectiveness:  Not  applicable/practical 


Discussion: 

Although  acids  can  readily  attack  the  metal  constituents  of  core,  plated  wire  or  twistor 
memories,  because  of  die  difficulty  of  accessing  these  media  and  getting  the  acid  to 
contact  the  appropriate  elements,  other  destruct  techniques  are  far  better  destruct  can¬ 
didates  for  three  media. 


Destruct  Method:  CHEMICAL  ACTION 
Storage  Medium:  Magnetic,  Bubble 
Effectiveness:  Not  applicable/practical 


Discussion: 

Bubble  memories  are  packaged  as  an  integral,  hermetically  sealed  unit  containing 
permanent  magnets  for  the  bias  field.  They  also  have  drive  coils  for  the  rotating  in¬ 
plane  field  in  addition  to  the  bubble  material  die  itself.  There  is  no  simple  combina¬ 
tion  of  chemicals  that  would  rapidly  penetrate  die  packaging  and  react  with  the  die. 
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Destruct  Method:  CHEMICAL  ACTION 
Storage  Medium:  Optical,  Microform 
Effectiveness:  High 

Process: 

The  microform  film  storage  medium  is  subjected  to  substances  that  dissolve  die  image 
containing  layer. 

Destruction  Issues: 

Risk  of  compromise 
-  Destruction  completeness 

High.  The  information  storing  emulsion  layer  can  be  completely  removed  from  the 
plastic  base. 

•  Information  concentration 

Microforms  are  small  and  highly  portable.  Microfilm  on  reels  tends  to  be  housed  in 
protective  boxes  or  cartridges  and  stored  in  special  file  cabinets.  Microfiche  are 
housed  in  protective  paper  sleeves  and  are  likewise  frequently  stored  in  cabinets. 
Because  they  are  flat  and  readily  available  in  “user  copies,"  microfiche  tend  to  be 
distributed  throughout  a  facility:  in  desk  drawers,  in  files,  etc. 


State  of  Destruct  Technology 

Small  chemical  destruct  units  are  presently  available.  These  units  are  primarily  for  the 
destruction  of  diazo  and  vesicular  microfiche. 


Discussion: 

The  emulsion  layer  of  exposed  silver  halide  films  is  composed  of  silver  particles  sus¬ 
pended  in  gelatin.  The  gelatin  dissolves  quickly  in  hot  water  —  the  emulsion  layer 
will  completely  dissolve  in  about  30  seconds  in  water  that  is  30  C.  The  polyester 
base  is  very  stable  and  is  not  readily  dissolved  by  organic  solvents. 

The  thin  emulsion  of  diazo  or  vesicular  films  dissolves  almost  instantaneously  in 
acetone,  methyl  ethyl  ketone,  and  methylene  chloride.  Other  organic  solvents  may 
likewise  dissolve  the  emulsion  layer.  Individual  sheets  of  film  are  destroyed  rapidly. 
Stacked  sheets  must  be  separated  by  paper  or  other  absorbent  material  that  draws  the 
solvent  to  all  parts  of  the  individual  sheet  surfaces.  Without  such  separators,  the  sol¬ 
vent  only  affects  the  emulsion  near  the  outer  edges  of  the  stack.  The  chemical  action 
at  the  edges  effectively  welds  or  seals  die  edges  and  prevents  the  solvent  from  reach¬ 
ing  the  interior  of  the  stack. 

The  reels  and  housing  of  microfilm  rolls  and  cartridges  may  delay  the  chemicals' 
ability  to  reach  the  microform  itself.  As  with  stacked  sheets,  rolled  film  prevents  the 
solvent  from  reaching  the  inner  surfaces.  Since  the  film  has  to  be  removed  from  the 
reels  or  cartridges  for  destruction,  throughput  may  be  significantly  affected.  Some 
form  of  universal  tool  for  rapidly  separating  the  film  from  the  reel  would  be  helpful  to 
this  and  other  destruct  methods. 
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Destruct  Method:  CHEMICAL  ACTION 
Storage  Medium:  Optical,  Laser- Accessed 
Effectiveness:  Unknown 


Discussion: 

Laser-accessed  information  storage  is  a  new  and  rapidly  evolving  technology.  As 
such,  no  dominant  product  types  have  yet  evolved.  Media  configurations  are  still 
highly  proprietary  and  experimental.  Without  specific  details  as  to  media  construction 
and  materials  (e.g.,  metal,  plastic,  glass),  it  is  difficult  to  predict  if  and  how  chemical 
action  would  be  effective  at  destroying  the  media  information  content  &  can  be  con¬ 
jectured  that  PMMA  (poly  methyl  methacrylate)  substrates  will  be  dissolved  by  chlo¬ 
rinated  organic  solvents  such  as  methylene  chloride,  glass  substrates  will  be  dis¬ 
solved  by  hydrofluoric  acid,  and  metal  substrates  by  mineral  acids.  It  is  difficult  to 
conjecture  what  chemicals  would  merely  strip  away  the  information  storing  layers. 


Dcstruct  Method:  CHEMICAL  ACTION 
Storage  Medium:  Punched,  Cards 
Effectiveness:  Poor 

Process: 

The  punched  cards  are  subjected  to  substances  that  chemically  react  with  the  paper. 
Destruction  Issues: 

Risk  of  compromise 

-  Destruction  speed 

Dependent  on  die  specific  chemicals,  their  concentration,  the  ambient  temperature,  the 
degree  of  agitation  and  quantity  of  media  to  be  destroyed.  Since  destruction  proceeds 
through  contact  with  die  surface,  cards  in  the  interior  of  a  stack  are  not  chemically  at¬ 
tacked  until  the  chemical  can  actually  reach  their  surface.  This  in  turn  affects  the  de¬ 
struction  speed. 

-  Destruction  completeness 

Medium  to  poor.  Since  punched  cards  are  a  low  density  information  storage  medi¬ 
um,  a  large  quantity  of  chemicals  would  be  necessary  to  destroy  the  number  of  cards 
expected  to  be  found  at  a  facility.  Furthermore,  since  information  is  represented  as 
punched  out  holes  in  the  cards,  the  cards  must  be  totally  dissolved  to  ensure  informa¬ 
tion  destruction. 


Information  concentration 

Computer  cards  tend  to  be  stored  in  fife  cabinets  designed  for  their  size,  in  cardboard 
boxes  holding  up  to  2,000  cards,  or  in  stacks  simply  bound  with  elastic  bands.  Al¬ 
though  cards  can  be  located  virtually  anywhere  in  a  facility,  they  tend  to  be  in  discreet 
clusters. 


State  of  Destruct  Technology 

No  existing  destruct  devices  using  this  process  were  identified. 


Discussion: 

Chemical  action  may  be  appropriate  only  for  relatively  small  quantities  of  punched 
card  media.  Destruction  of  large  quantities  of  material  may  not  be  practical  due  to  the 
quantity  of  chemicals  required,  the  thickness  of  computer  card  paper,  and  the  need  to 
bring  the  chemicals  into  actual  contact  with  the  medium  surface  for  the  reaction  to 
proceed. 

The  cellulose  constituent  of  paper  is  very  susceptible  to  acid  hydrolysis.  Hot,  con¬ 
centrated  sulfuric  acid  is  the  best  acid  for  attacking  the  cellulose.  Upon  contact  with 
sulfuric  acid,  papa-  turns  brown  almost  immediately  and  is  reduced  into  a  gel-like 
mass  in  a  matter  of  minutes.  Other  acids,  such  as  nitric  acid  and  hydrochloric  acid, 
will  hydrolyze  cellulose,  but  are  not  nearly  as  effective  as  sulfuric  acid.  The  heat  to 
enhance  the  chemical  attack  of  cellulose  can  be  generated  easily  by  adding  a  small 
amount  of  water  to  the  acid.  In  the  process  of  dilution,  sulfuric  acid  and  other  miner¬ 
al  acids  generate  a  considerable  amount  of  heat 
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Cellulose  is  not  as  susceptible  to  alkaline  hydrolysis.  During  the  manufacture  of  oa- 
ccUulose  is  actually  cooked  in  a  solution  of  sodiumhydroxide  (a  strcmg  al£- 
h)  and  sodium  sulfide.  Thus,  alkalis  are  not  good  candidates  for  paper  destruction 
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Destruct  Method:  CHEMICAL  ACTION 
Storage  Medium:  Punched,  Tape 
Effectiveness:  Poor 

Process: 

The  punched  tape  is  subjected  to  substances  that  either  chemically  react  with  die  paper 
base  tapes  or  dissolve  the  Mylar  base  tapes. 

Destruction  Issues: 

System  Overhead  Concerns 


-  Manpower  requirements 

Personnel  are  requited  to  collect  the  media,  transport  diem  to  the  dcstruct  equipment, 
and  place  them  into  the  container.  Tapes  may  need  to  be  unwound  from  reels.  In 
addition,  the  chemicals  must  be  poured  or  otherwise  brought  into  contact  with  the 
media,  and  the  mixture  agitated  to  assist  die  chemical  action. 


Risk  of  compromise 

-  Destruction  completeness 

If  the  chemicals  are  allowed  to  totally  hydrolyze  the  paper  tape,  complete  destruction 
is  possible.  The  oil  content  of  some  tapes  may  affect  wetting  and,  therefore,  the  de- 
struct  process  effectiveness. 

-  Information  concentration 

Computer  punched  tapes  tend  to  be  wound  on  reels  up  to  14  inches  in  diameter, 
stared  as  coils,  or  fanfolded  in  containers. 


State  of  Destruct  Technology 

No  existing  destruct  devices  using  this  process  were  identified. 


Discussion: 

Chemical  action  may  be  appropriate  only  for  relatively  small  quantities  of  media.  De¬ 
struction  of  large  quantities  of  material  may  not  be  practical  due  to  the  quantity  of 
chemicals  that  would  be  required,  and  the  need  to  bring  the  chemicals  into  actual 
contact  with  the  medium  for  die  chemical  action  to  take  place. 

Paper  and  mylar  tapes  would  require  different  destruct  chemicals.  The  cellulose  con¬ 
stituent  ofpaper  punch  time  is  susceptible  to  acid  hydrolysis.  Hot,  concentrated  sul¬ 
furic  acid  is  the  best  acid  for  attacking  the  cellulose.  Upon  contact  with  sulfuric  acid, 
paper  turns  brown  almost  immediately  and  is  reduced  into  a  gel-like  mass  in  a  matter 
of  minutes.  Other  acids,  such  as  nitric  acid  and  hydrochloric  acid,  will  hydrolyze 
cellulose,  but  are  not  nearly  as  effective  as  sulfuric  acid.  The  heat  to  enhance  the 
chemical  attack  of  cellulose  can  be  generated  easily  by  adding  a  small  amount  of  water 
to  the  acid.  In  the  process  of  dilution,  sulfuric  acid  and  other  mineral  acids  generate  a 
considerable  amount  of  heat 

Cellulose  is  not  as  susceptible  to  alkaline  hydrolysis.  During  the  manufacture  of  pa- 
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per,  the  cellulose  is  actually  cooked  in  a  solution  of  sodium  hydroxide  (a  strong  alka¬ 
li)  and  sodium  sulfide.  Thus,  alkalis  are  not  good  candidates  for  paper  destruction. 

Mylar  is  very  stable  and  resistant  to  chemical  attack.  A  specific  solvent  that  would 
attack  Mylar  effectively  has  not  been  identified. 


f 
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Destruct  Method:  CHEMICAL  ACTION 
Storage  Medium:  Paper,  All  Types 
Effectiveness:  Possibly  Medium 

Process: 

The  paper  is  subjected  to  chemicals  that  react  with  the  paper,  causing  it  to  disintegrate 
and  thereby  obliterate  the  information  content 

Destruction  Issues: 

Risk  of  compromise 

-  Destruction  speed 

Depends  on  the  specific  chemicals,  their  concentration,  the  ambient  temperature,  the 
degree  of  agitation,  the  quantity  of  paper  to  be  destroyed,  and  the  specific  properties 
of  the  paper.  Since  the  destruct  process  requires  the  chemical  to  wet  the  paper,  indi¬ 
vidual  sheets  will  be  destroyed  much  more  quickly  than  stacks  or  bound  volumes  that 
impede  the  chemical's  ability  to  get  to  the  paper.  Coatings  on  some  papers  may  like¬ 
wise  impede  the  chemical  action. 

-  Destruction  completeness 

Possibly  high.  Provided  that  a  sufficient  quantity  of  chemical  is  brought  into  contact 
with  the  media,  complete  destruction  is  possible. 

-  Information  concentration 

Paper  tends  to  be  randomly  distributed  everywhere  throughout  a  facility.  Some  de¬ 
gree  of  information  concentration  exists  in  the  form  of  file  cabinets. 


State  of  Destruct  Technology 

No  existing  destruct  devices  using  this  process  were  identified. 


Discussion: 

Chemical  action  may  be  appropriate  for  relatively  small  quantities  of  paper  media. 
Destruction  of  large  quantities  of  material  may  not  be  practical  due  to  the  quantity  of 
chemicals  required  and  the  relative  slowness  of  the  process  in  reaching  the  interior 
pages  of  bound  documents. 

The  cellulose  constituent  of  paper  is  very  susceptible  to  acid  hydrolysis.  Hot,  con¬ 
centrated  sulfuric  acid  is  die  best  acid  for  attacking  the  cellulose.  Upon  contact  with 
sulfuric  acid,  paper  turns  brown  almost  immediately  and  is  reduced  into  a  gel-like 
mass  in  a  matter  of  minutes.  Other  acids,  such  as  nitric  acid  and  hydrochloric  acid, 
will  hydrolyze  cellulose,  but  are  not  nearly  as  effective  as  sulfuric  acid.  The  heat  to 
enhance  the  chemical  attack  of  cellulose  can  be  generated  easily  by  adding  a  small 
amount  of  water  to  the  acid.  In  the  process  of  dilution,  sulfuric  acid  and  other  miner¬ 
al  acids  generate  a  considerable  amount  of  heat 

Cellulose  is  not  as  susceptible  to  alkaline  hydrolysis.  During  the  manufacture  of  pa¬ 
per,  tire  cellulose  is  actually  cooked  in  a  solution  of  sodium  hydroxide  (a  strong  alka¬ 
li)  and  sodium  sulfide.  Thus,  alkalis  are  not  good  candidates  for  paper  destruction. 
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Generic  Description  of  ERASING 


Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  Characteristics 

The  equipment  that  erases  madia  can  be  either  integral  to  the  information  processing 
equipment,  or  can  be  a  separate  device.  Erase  equipment  that  is  integral  to  the  infor¬ 
mation  processing  equipment  presents  no  additional  overhead  concerns  based  on  its 
physical  characteristics.  The  physical  characteristics  of  external  erase  equipment  de¬ 
pend  on  the  manufacturer  and  equipment  type. 

-  Utility  requirements 

Depend  on  the  specific  equipment  configuration.  Some  types  of  equipment  require 
electric  power. 

-  Manpower  requirements 

In  systems  that  utilize  erase  equipment  that  is  external  to  the  information  processing 
system,  personnel  are  needed  to  access,  remove,  collect  and  transport  the  media  to  the 
erasing  equipment,  to  load  the  media,  and  then  to  operate  the  erasing  equipment. 
Specific  information  storage  media  may  affect  how  this  task  can  be  performed.  In 
information  processing  systems  configured  with  an  internal  erase  capability,  the  erase 
process  may  be  initiated  by  some  form  of  command  or  trigger,  and  may  proceed 
without  further  human  intervention.  With  removable  media,  however,  personnel  may 
have  to  first  access,  remove,  collect  and  transport  the  media  to  the  information 
processing  equipment,  and  then  mount  the  media  onto  the  equipment  and  operate  the 
equipment 


Safety  Concerns 

-  Process 

Generally,  the  process  poses  no  significant  hazards. 

-  Materials 

Erasing  requires  no  hazardous  materials. 

-  Accidental  trigger 

Configurations  where  the  erase  mechanism  is  part  of  the  information  processing 
equipment  may  be  vulnerable  to  accidental  trigger.  Likewise,  media  storage  con¬ 
tainers  which  also  have  media  erase  capabilities  may  be  vulnerable  to  accidental  trig¬ 
ger. 


Emergency  environment 

Aside  from  the  increased  risk  of  performing  any  task  under  adverse  conditions,  the 
emergency  environment  does  not  present  new  or  exacerbate  existing  hazards 
associated  with  the  destruction  process. 
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•  Destruction  speed 

Highly  variable.  The  destruction  speed  depends  on  the  specific  characteristics  of  the 
erase  equipment,  the  type  of  medium,  and  the  quantity  erf  media.  Media  can  be  erased 
by  subjecting  them  to  either  a  bulk  erase  process  or  a  process  whereby  each  individu¬ 
al  "memory"  location  is  individually  accessed  and  then  erased.  The  former  can  be 
quite  rapid,  the  latter  can  be  much  slower. 

-  Throughput 

Throughput  can  be  partitioned  into  two  elements:  the  efficiency  of  transporting, 
loading,  and  otherwise  preparing  the  media  to  the  level  that  the  erasing  equipment  can 
act  upon  it;  and  the  quantity  of  magnetic  media  that  can  be  processed  in  a  single  erase 
cycle.  Both  the  speed  with  which  the  erase  equipment  can  be  brought  to  bear  on  the 
media  and  the  speed  of  the  erase  process  depend  on  facility-medium-equipment 
factors. 

-  Premature  termination 

It  is  possible  to  terminate  prematurely  by  stopping  the  erase  process  before  it  has 
deleted  the  stored  information  sufficiently  to  include  information  recovery.  De¬ 
pending  on  the  specific  equipment  configuration,  this  may  be  accomplished  by 
physically  removing  the  medium  from  the  equipment,  or  by  shutting  off  the  electric 
power. 

-  Destruction  completeness 

Depends  on  specific  erase  technology-medium  factors.  Some  erase  processes  leave  a 
slight  remnant  of  the  information  that  had  been  stored. 

-  Detectability 

Generally,  erasure  cannot  be  detected  from  outside  the  immediate  vicinity  of  the  de- 
struct  effort 

-  Information  concentration 

Depends  on  specific  medium-facility  factors.  Information  frequently  will  be  con¬ 
centrated  in  file  cabinets  or  bookcases.  Since  information  is  rarely  cataloged  and 
stored  by  sensitivity  category,  a  major  task  may  be  the  identification  and  separation  of 
highly  sensitive  information  from  less  sensitive  material. 

-  Medium  accessibility 

Depends  on  specific  medium-facility-equipment  factors.  The  difficulty  and  com¬ 
plexity  of  accessing  media  is  set,  in  part,  by  the  specific  medium,  and  whether  it  was 
designed  to  be  user-accessible.  Accessing  media  that  is  an  integral  component  of  the 
information  processing  equipment  may  be  relatively  complex,  and  may  require  special 
tools  and  training.  If  such  media  can  be  erased  without  removal  by  a  process  that  is  a 
feature  of  the  equipment ,  then  accessibility  is  not  a  significant  factor.  If  the  media 
must  be  removed  in  order  to  erase  them,  then  accessibility  may  play  a  major  role. 
Facilities  may  have  procedures  and  practices  whereby  certain  user-accessible  media 
are  stored  in  secure  containers  or  housings,  which  in  turn  may  delay  accessing  the 
actual  media. 


State  of  Destruct  Technology 

Sophisticated  erase  methods  have  been  developed  and  implemented  for  some  media. 


Destruct  Method:  ERASING 
Storage  Medium:  Semiconductor,  ROM 
Effectiveness :  Not  applicable/practical 


Discussion: 

ROMs  are  programmed  during  die  semiconductor  fabrication  process.  There  is  no  way 
for  these  devices  to  be  field  erased. 
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Destruct  Method:  BIASING 
Storage  Medium:  Semiconductor,  RAM 
Effectiveness:  High 

Process: 

The  memory  contents  are  overwritten  to  some  predetermined  value,  or  are  simply  lost 
when  power  is  disconnected. 

Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  Characteristics 

Usually  exists  as  a  feature  of  the  information  processing  equipment 

-  Utility  requirements 

Power  may  be  necessary,  although  in  most  cases  the  loss  of  power  will  clear  the 
memory  contents. 


Safety  Concerns 
-  Accidental  trigger 

The  memory  contents  can  be  accidentally  erased  if  the  "erase"  command  is  acci¬ 
dentally  entered,  or  the  power  to  the  information  processing  equipment  equipment  is 
removed. 


Risk  of  compromise 

-  Destruction  speed 

The  entire  contents  of  a  RAM  semiconductor  memory  can  be  completely  erased  in 
less  than  a  second. 

-  Throughput 

Depends  on  the  personnel's  ability  to  access  and  power  down  all  the  various  equip¬ 
ment  at  a  facility,  or  to  enter  the  appropriate  "erase"  commands.. 

-  Premature  termination 

Sometimes  possible  if  the  equipment  is  powered  back  up  almost  immediately  and  the 
memory  contents  have  not  yet  decayed  sufficiently  (most  systems,  however,  will 
dear  the  memory  upon  power  up). 

•  Destruction  completeness 

Very  good.  Tne  memory  contents  are  erased,  but  under  some  conditions,  the  prior 
memory  contents  can  actually  be  retrieved,  albeit  with  elaborate  equipment  and 
procedures. 
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-  Information  concentration 

The  information  is  located  within  the  integrated  circuits  that  are  soldered  onto  circuit 
cards  comprising  the  information  processing  equipment  As  such,  equipment  con¬ 
taining  RAMs  can  be  distributed  throughout  a  facility.  Furthermore,  compact  portable 
equipment  may  contain  RAM  semiconductor  memory  circuits  and  it  may  be  difficult 
to  find  this  equipment  rapidly  in  an  emergency. 

.  Medium  accessibility 

Not  an  issue,  since  the  "erase"  command  would  be  issued  either  through  die  normal 
input  keyboard  or  via  some  form  of  "panic"  button. 


State  of  Destruct  Technology 

Proven  and  existing  technology. 


Discussion: 

RAMs  are  considered  to  be  volatile  memories,  and  under  most  circumstances,  the 
RAM  components  of  an  information  processing  system  memory  will  lose  their  con¬ 
tents  as  soon  as  external  power  to  the  equipment  is  removed.  Some  RAMs,  howev¬ 
er,  are  made  by  including  special  tiny  batteries  inside  the  device  package.  These  bat¬ 
teries  provide  just  enough  standby  current  to  retain  the  memory  contents  after  the  ex¬ 
ternal  power  is  removed.  Similarly,  some  system  designs  include  small,  rechargeable 
batteries  on  the  same  circuit  card  as  die  memory  components  that  supply  die  requisite 
power  after  system  power  is  removed.  Therefore,  it  should  not  be  assumed  that  just 
because  a  memory  element  is  a  RAM  component  that  it  is  in  fact  volatile. 
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Destruct  Method:  ERASING 
Storage  Medium:  Semiconductor,  PROM 
Effectiveness:  Not  applicable/practical 


Discussion: 

PROMs  are  field  programmed  using  special  equipment  thst  addresses  the  appropriate 
memory  cell  and  applies  current  that  bums  out  a  fusible  link  and  "sets"  the  memory 
consents.  Although  these  devices  can  be  field  programmed  so  that  all  the  memory 
locations  are  set  to  the  same  value,  this  process  must  be  accomplished  by  first 
removing  the  PROM  from  its  circuit,  and  then  placing  it  into  a  special  instrument  for 
programming  such  devices.  This  procedure  is  too  time  consuming,  and  therefore  is 
unpractical  for  emergency  destruction. 
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Destruct  Method:  ERASING 
Storage  Medium:  Semiconductor,  EPROM 
Effectiveness:  Not  applicable/practical 


Discussion:  _ 

EPROMs  can  be  bulk  erased  using  intense  ultra-violet  light  The  EPROM  device  to 
be  erased  is  removed  from  the  circuit  and  placed  in  an  EPROM  eraser  that  illuminates 
die  silicon  the  through  the  quarts  window  provided  in  the  device  package.  Atypical 
eraser  can  hold  about  10  EPROMs  and  requites  that  the  EPROM  be  exposed  to  the 
ultra-violet  light  for  about  45  minutes.  An  erased  EPROM  still  contains  some 
remnant  signsl  indicstive  of  the  previously  stored  information.  Although  this  signal 
does  not  interfere  with  the  subs^uent  writing  of  new  information,  with  proper  in¬ 
strumentation  wd  probing  techniques,  the  prior  information  content  can  be  deduced. 
Therefore,  due  to  the  long  erasure  time  and  die  remnant  signal,  erasure  is  not  a  viable 
method  for  emergency  detraction  of  information  stored  on  an  EPROM. 
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Destruct  Method:  ERASING 

Storage  Medium:  Semiconductor,  EEPROM 

Effectiveness:  High 

Process: 

The  memory  contents  are  overwritten  to  some  predetermined  value. 
Destruction  braes: 

System  Ovcrtrad  Cnnccna 

-  Physical  Characteristics 

Usually  exists  as  a  feature  of  the  information  processing  equipment 

-  Utility  requirements 

External  power  is  necessary. 


Safety  Concerns 
•  Accidental  trigger 

The  memory  contents  can  be  accidentally  erased  if  the  "erase"  command  is  acci 
dentally  entered 


Kakofcompromuc 

-  Destruction  speed  _ 

The  entire  contents  of  an  EEPROM  semiconductor  memory  can  be  completely  erased 
in  less  than  a  second. 

-  Throughput 

Depends  on  the  personnel's  ability  to  enter  die  appropriate  "erase"  commands. 

.  Premature  termination 

Unknown  -  probably  not  possible  once  "erase"  command  is  executed. 

-  Destruction  completeness 

Very  good,  line  memory  contents  are  erased,  but  under  some  conditions,  the  prior 
memory  contents  actually  can  be  retrieved,  albeit  with  elaborate  equipment  and 
procedures. 

-  Information  concentration 

The  information  is  located  within  the  integrated  circuits  that  are  soldered  onto  circuit 
cards  comprising  die  information  processing  equipment  As  such,  equipment  con¬ 
taining  EEPROMs  can  be  distributed  throughout  a  facility.  Furthermore,  compact 
portable  equipment  may  contain  EEPROM  semiconductor  memory  circuits  and  it  may 
be  difficult  to  find  this  equipment  rapidly  in  an  emergency. 

-  Medium  accessibility 

Not  an  issue,  since  the  "erase"  command  would  be  issued  either  through  the  normal 
input  keyboard  or  via  some  form  of  "punk"  button. 
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State  of  Destruct  Technology 

Proven  and  existing  technology. 


Discussion; 

EEPROMs  stove  information  by  transferring  electric  charge  to  a  "floating”  gate.  As  a 
result,  even  after  erasure,  there  may  still  be  a  remnant  charge  which  may  be  measured 
to  determine  the  memory  contents  prior  to  erasure.  Since  such  measurements  would 
require  elaborate  equipment  and  expertise,  it  can  be  assumed  that  the  risk  of 
compromise  from  such  analysis  is  rather  low. 


Destruct  Method:  ERASING 

Storage  Medium:  Semiconductor,  NO  VRAM 

Effectiveness:  High 

Process: 

The  memory  contents  are  overwritten  to  seme  predetermined  value. 

Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  Characteristics 

Usually  exists  as  a  feature  of  the  information  processing  equipment 

•  Utility  requirements 

External  power  is  necessary. 

Safety  Concerns 

-  Accidental  trigger 

The  memory  contents  can  be  accidentally  erased  if  the  "erase"  command  is  accr 
dentally  entered. 

Risk  of  compromise 


-  Destruction  speed 

The  entire  contents  of  an  NOVRAM  semiconductor  memory  can  be  completely  erased 
in  less  than  a  second. 


-  Throughput 

Depends  on  the  personnel's  ability  to  enter  die  appropriate  "erase"  commands. 

-  Premature  termination 

Unknown  -  probably  not  possible  once  "erase"  command  is  executed. 

-  Destruction  completeness 

Very  good.  The  memory  contents  are  erased,  but  under  some  conditions,  the  prior 
memory  contents  actually  can  be  retrieved,  albeit  with  elaborate  equipment  and 
procedures. 

-  Information  concentration 

The  information  is  located  within  the  integrated  circuits  that  are  soldered  onto  circuit 
ends  comprising  die  information  processing  equipment  As  such,  equipment  con¬ 
taining  NOVRAMs  can  be  distributed  throughout  a  facility.  Furthermore,  compact 
portable  equipment  may  contain  NOVRAM  semiconductor  memory  circuits  and  it 
may  be  difficult  to  find  this  equipment  rapidly  in  an  emergency. 

-  Medium  accessibility 

Not  an  issue,  since  the  "erase"  command  would  be  issued  either  through  the  normal 
input  keyboard  or  via  some  form  of  "panic"  button. 
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State  of  Destruct  Technology 

Proven  and  existing  technology. 


Discussion:  _ 

NOVRAMs  consist  of  a  RAM  memory  interleaved  with  an  EEPROM.  The  circuit  is 
usually  utilized  to  serve  as  a  non-volatile  memory  in  the  event  of  a  power  failure. 
When  die  power  dips  below  some  pic-determined  value,  the  contents  of  the  RAM 
memory  are  rapidly  transferred  into  the  EEPROM  One  way  of  clearing  the  EEP¬ 
ROM  is  to  "clear'1  die  RAM  prior  to  power  down. 


F-12 


Destruct  Method:  ERASING  (degaussing) 

Storage  Medium:  Magnetic,  Recording,  Removable  (tape,  cartridge,  cassette,  wafer,  card, 
strip,  floppy  disk,  hard  disk) 

Effectiveness:  High 

Process: 

The  medium  is  subjected  to  a  strong  magnetic  field  that  changes  the  magnetization 
representing  the  stored  information. 

Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  Characteristics 

The  equipment  size  is  variable.  It  ranges  from  hand-held  permanent  magnets  to  a  5 
foot  high  equipment  rack. 

•  Utility  requirements 

Some  degaussers  require  electric  power.  The  power,  however,  may  be  supplied  by 
internal  batteries. 

-  Manpower  requirements 

Generally,  personnel  are  needed  to  access,  remove,  collect  and  transport  the  media  to 
die  degausser,  insert  them  into  die  degaussing  chamber,  and  operate  the  machine. 


Safety  Concerns 

-  Accidental  trigger 

Possible  in  units  that  also  serve  as  storage  containers;  otherwise,  it  is  not  likely  since 
the  media  has  to  be  inserted  into  the  device  and  the  device  activated. 


Kfr  of  compromise 

-  Destruction  meed 

Media  can  be  degaussed  in  less  than  one  minute. 

-  Throughput 

Throughput  can  be  partitioned  into  two  elements:  getting  the  media  to  the  degaussing 
equipment  and  actually  degaussing  the  media.  The  speed  with  which  the  material  can 
be  Nought  and  fed  to  the  equipment  is  site,  manpower,  and  media  specific.  The 
actual  degaussing  throughput  is  dependent  on  the  volume  capacity  of  die  machine,  the 
cycle  time,  and  the  number  of  degaussing  units  available  that  can  be  used  in  parallel. 
A  typical  throughput  is  one  10  inch  red  of  1/2  inch  tape  per  minute. 

•  Premature  termination 

The  erase  process  can  be  terminated  prior  to  completion  by  disconnecting  system 
power  or  removing  the  media  from  die  degausser.  Such  media  may  be  partially  dam¬ 
aged. 


✓ 


F-13 


-  Destruction  completeness 

Medium  to  excellent  Degaussing  may  leave  some  detectable  remanent  A  higher  de¬ 
gree  of  erasure  can  be  accomplished  with  multiple  passes. 

-  Information  concentration 

Dependent  on  the  specific  medium. 

-  Medium  accessibility 

Dependent  on  the  specific  medium. 


State  of  Destruct  Technology 

Proven  technology  with  numerous  fielded  models. 


Discussion: 

Modem  signal  processing  techniques  enable  the  recovery  of  erased  information  al¬ 
most  irrespective  of  the  erasing  method  employed.  The  limiting  factor  is  the  amount 
of  processing  time  necessary  to  extract  the  information.  Since  facilities  store  billions 
of  bits  of  information  on  recording  media,  erasure  to  the  level  that  requires  on  the  or¬ 
der  of  a  second  of  processing  time  to  recover  a  bit  of  information  renders  recovery 
impractical  unless  the  quantity  of  material  to  be  processed  is  very  small.  If  the  adver¬ 
sary  has  access  to  an  index  or  other  directory  of  the  contents  of  the  storage  medium, 
he  potentially  can  identify  the  exact  regions  of  the  medium  that  contain  the  informa- 
don  of  interest  to  him,  and  limit  his  recovery  efforts  to  that  region. 

To  erase  the  stored  information  to  a  level  that  makes  information  recovery  impractical, 
a  magnetic  field  5  times  as  strong  as  the  coerrivity  of  the  recording  medium  is 
necessary.  Recording  media  are  degaussed  most  efficiently  if  the  magnetic  field  is 
applied  along  the  easy  direction  of  magnetization.  Such  a  field  can  be  generated  by  a 
permanent  magnet  or  by  passing  a  current  through  coils  designed  to  produce  a  mag¬ 
netic  field. 

In  the  method  that  makes  use  of  permanent  magnets,  the  magnet  is  simply  passed 
very  close  to  die  medium  surface.  The  two  primary  difficulties  with  permanent  mag¬ 
nets  are:  1)  magnetic  field  strength  decreases  very  rapidly  as  the  distance  from  the 
magnet  is  increased  —  by  a  factor  proportional  to  the  distance  from  magnet  cubed;  and 
2)  permanent  magnets  of  sufficient  strength  are  extremely  expensive  -  thousands  of 
dollars.  Thus,  for  example,  if  a  magnet  is  passed  along  a  reel  of  recording  tape,  the 
edges  of  the  tape  near  the  reel  flanges  would  be  subjected  to  a  much  stronger  field 
than  the  portion  of  the  tape  between  the  two  edges. 

Most  degaussing  equipment  utilizes  capacitors  discharged  into  multiple  coils  to 
generate  a  strong  pulsed  magnetic  field.  The  coils  may  be  oriented  so  as  to  provide 
fields  in  several  directions  or  the  medium  itself  may  be  mechanically  rotated.  This 
ensures  that  all  parts  of  the  medium  will  be  subjected  to  a  magnetic  field  that  is 
parallel  to  the  easy  direction  of  magnetization. 

Perpendicularly  recorded  media,  which  are  expected  to  be  in  use  soon,  may  not  be 
degaussed  properly  by  existing  equipment.  If  inserted  into  degaussers  configured  for 
longitudinal  media,  perpendicular  media  would  not  be  subjected  to  the  strongest 
magnetic  field  along  their  easy  direction  of  magnetization. 

One  final  issue  that  must  be  taken  into  consideration  when  evaluating  the  effec- 
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tiveness  of  destruction  by  degaussing,  is  the  prior  history  of  the  recorded  medium.  If 
the  medium  has  been  stored  at  an  elevated  temperature  (temperatures  >80°F)  for  more 
than  a  few  days,  or  if  the  medium  has  stored  the  same  data  for  several  cm-  more  years, 
then  there  exists  the  possibility  that  the  previously  recorded  signal  may  be  recoverable 
even  after  degaussing.  Such  storage  conditions  may  cause  this  problem  because  the 
binder  is  like  an  extremely  viscous  fluid  that  has  oxide  particles  suspended  in  it 
During  medium  manufacture,  before  the  binder  has  cured,  the  oxide  particles  are 
oriented  so  they  align  in  one  direction.  Following  recording,  the  magnetic  forces  on 
die  oxide  particles  are  such  that,  but  for  the  binder,  the  particles  would  physically  re¬ 
orient  Normally  the  viscosity  of  the  binder  is  sufficient  to  prevent  such  re¬ 
orientation;  but,  with  extended  storage  or  with  storage  at  elevated  temperatures,  some 
re-orientation  does  occur.  This  re-orientation  can  be  measured  after  degaussing. 


F-15 


Dcstruct  Method:  ERASING  (degaussing) 

Storage  Medium:  Magnetic,  Recording,  Fixed  (hard  disk,  drum) 

Effectiveness:  Possibly  High 

Process: 

The  medium  is  subjected  to  a  strong  magnetic  field  that  changes  the  magnetization 
representing  die  stored  information. 

Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  Characteristics 

The  destruction  device  is  a  small,  hand-held  permanent  magnet 

-  Manpower  requirements 

Generally,  personnel  are  needed  to  access  the  media  and  to  manually  move  the  mag¬ 
net  along  the  medium  surface. 


Risk  of  compromise 

-  Destruction  speed 

The  magnet  need  only  be  brought  into  dose  proximity  of  the  medium  surface  and  the 
information  content  of  the  medium  area  immediately  in  the  vicinity  of  the  magnet  is 
destroyed. 

-  Throughput 

Throughput  can  be  partitioned  into  two  elements:  accessing  the  media  and  actually 
degaussing  the  media.  The  speed  with  which  the  material  can  be  accessed  depends 
on  the  specific  design  of  the  storage  equipment  The  actual  degaussing  throughput  is 
dependent  on  the  surface  area  to  be  degaussed  and  the  ease  with  which  all  the  neces¬ 
sary  areas  can  be  reached. 

-  Premature  termination 

The  personnel  can  be  prevented  from  completing  their  task. 

•  Destruction  completeness 

Medium  to  excellent  Degaussing  may  leave  some  detectable  remanent .  Careless 
operator  procedures  may  leave  patches  of  media  intact 

-  Information  concentration 

The  storage  unit  containing  the  media  is  connected  to,  or  mounted  inside,  the  in¬ 
formation  processing  equipment 

-  Medium  accessibility 

Poor.  Special  tools  are  required,  numerous  screws  may  have  to  be  removed,  and 
seals  must  be  broken. 
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State  of  Destruct  Technology 

Actual  effectiveness  of  technology  is  unknown. 


Discussion: 

The  two  primary  difficulties  with  permanent  magnets  are:  1)  permanent  magnets  of 
sufficient  strength  are  extremely  expensive  -  thousands  of  dollars;  and  2)  the  field 
strength  decreases  very  rapidly  as  the  distance  from  the  magnet  is  increased  -  by  a 
factor  proportional  to  die  distance  from  die  magnet  cubed.  Thus,  for  example,  if  a 
magnet  is  passed  too  high  above  the  medium  surface,  the  medium  may  not  be  de¬ 
gaussed  at  alL 


Destruct  Method:  ERASING  (overwriting) 
Storage  Medium:  Magnetic,  Recoding,  All  Types 
Effectiveness:  High 


Process: 

The  medium  is  subjected  to  a  strong  magnetic  field  tha l  changes  die  magnetization 
representing  die  stored  information. 

Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  Characteristics 

The  equipment  necessary  to  erase  magnetic  media  by  overwriting  is  usually  a  feature 
of  the  information  processing  equipment  utilizing  the  media. 

-  Utility  requirements 

Electric  power  to  operate  the  information  processing  equipment 

-  Manpower  requirements 

Personnel  are  needed  to  identify,  locate  and  transport  the  media  to  the  drive  unit 
mount  the  media  onto  the  (hive,  and  initiate  the  erase  process. 


Risk  of  compromise 

-  Destruction  .peed 

Depends  on  media  type  and  storage  capacity. 

-  Throughput 

Throughput  is  limited  by  the  personnel's  ability  to  get  the  media  to  the  drive  unit  and 
the  equipment's  speed  at  overwriting  the  media. 

-  Premature  termination 

The  erase  process  can  be  terminated  prior  to  completion  by  disconnecting  information 
processing  system  power  or  issuing  a  command  sequence  terminating  the  overwrite 
process. 

-  Destruction  completeness 

Medium  to  excellent  Overwriting  may  leave  some  detectable  remanent .  Multiple 
passes  overwriting  alternating  ones  and  zeros  reduces  the  amount  of  remnant  that  can 
be  discerned. 

-  Information  concentration 

Dependent  on  the  specific  medium. 

-  Medium  accessibility 

Dependent  on  the  specific  medium. 


State  of  Destruct  Technology 

Proven  technology  existing  on  all  information  processing  equipment 
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Discussion: 

Modem  signal  processing  techniques  enable  the  recovery  of  erased  information  al¬ 
most  irrespective  of  die  erasing  mkhod  employed.  The  limiting  factor  is  die  amount 
of  processing  time  necessary  to  extract  die  information.  Since  facilities  store  billions 
of  bits  of  information  on  recording  media,  erasure  to  the  level  that  requires  on  die  or¬ 
der  of  a  second  of  processing  time  to  recover  a  bit  of  information  renders  recovery 
impractical  unless  the  quantity  of  material  to  be  processed  is  very  small.  If  the  adver¬ 
sary  has  access  to  an  index  or  other  directory  of  the  contents  of  die  storage  medium, 
he  potentially  can  identify  the  exact  regions  of  the  medium  that  contain  the  informa¬ 
tion  of  interest  to  him,  and  limit  his  recovery  efforts  to  that  region. 

To  erase  the  stored  information  to  a  level  that  makes  information  recovery  impractical, 
it  is  necessary  to  apply  a  magnetic  field  5  times  at  strong  as  the  coercivity  of  the 
recording  medium.  A  magnetic  recording  head  generates  magnetic  field  that  is  about 
750  to  1500  Oe.  Low  coercivity  media  (L  e.  260  Oe),  can  be  readily  overwritten 
with  this  strength  field.  High  coercivity  media  (L  e.  700  Oe)  retain  a  significant 
remnant  Although  this  remnant  does  not  interfere  with  information  subsequently 
recorded  on  the  media,  it  can  be  discerned  with  signal  processing  techniques. 

Most  information  processing  equipment  provides  a  command  to  delete  the  complete 
medium  or  only  specified  files,  but  the  process  involved  does  not  truly  erase  the  in¬ 
formation.  Rather,  only  the  references  to  the  appropriate  files  in  the  medium  directo¬ 
ry  are  deleted,  allowing  that  storage  space  to  be  overwritten  at  some  later  time.  Such 
processes  should  not  be  relied  upon  for  emergency  destruction  since  the  information 
is  readily  recoverable  with  simple  software  tools. 


Destruct  Method:  ERASING 

Storage  Medium:  Magnetic,  Current-Accessed,  Core 

Effectiveness:  High 


Process: 

Each  memory  location  is  addressed  and  overwritten  with  some  random  value. 
Destruction  Issues: 

System  Qygtsari  Concern 

-  Physical  Characteristics 

Usually  exists  as  a  feature  of  the  mfbnnation  processing  equipment 

-  Utility  requirements 

The  information  processing  equipment  must  be  operable. 


Safety  Concerns 
-  Accidental  trigger 

The  memory  contents  can  be  unintentionally  erased  if  the  "erase"  command  is  ac 
cidentally  entered. 


Risk  of  compromise 

-  Destruction  speed 

Depends  on  the  clocking  speed  of  the  information  processing  equipment  The  de¬ 
struct  speed  also  depends  on  the  degree  of  erasure  required,  since  the  contents  should 
be  overwritten  multiple  times  to  truly  remove  all  remnants  of  the  previously  stored 
information. 

-  Throughput 

It  should  be  possible  to  overwrite  the  entire  memory  contents  a  sufficient  number 
times  in  the  span  of  a  few  minutes  to  preclude  recovery  of  the  previously  stored  in¬ 
formation. 

-  Premature  termination 

Possible  to  terminate  by  either  overriding  the  "erase"  command  or  by  removing  pow¬ 
er  to  the  information  processing  equipment 

-  Destruction  completeness 

Medium  to  excellent  The  absolute  degree  of  memory  erasure  depends  on  the  number 
of  overwrite  cycles  accomplished. 

-  Information  concentration 

The  information  is  located  within  die  memory  planes,  which  are  integral  to  the  in¬ 
formation  processing  equipment  As  such,  equipment  containing  core  memory  mod¬ 
ules  can  be  distributed  throughout  a  facility.  Furthermore,  portable  equipment  may 
contain  core  memory  modules  and  it  may  be  difficult  to  rapidly  find  this  equipment  in 
an  emergency. 
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-  Medium  accessibility 

Not  an  issue  since  the  memory  demons  are  accessed  electronically  through  the  the 
information  processing  system  control  structure. 


State  of  Destruct  Technology 

Overwrite  technology  is  an  existing  capability  of  most  information  processing  equip¬ 
ment 


Discussion: 

The  DoD- approved  method  for  declassifying  magnetic  core  memory  calls  for  over¬ 
writing  all  addressable  data  locations  by  writing  any  one  character,  then  its  comple¬ 
ment  alternately  for  1000  cycles,  followed  by  overwriting  with  unclassified  random 
data.  Department  of  Defense  Magnetic  Remanence  Security  Guideline,  National 
Computer  Security  Center,  IS  November,  1985,  at  IS. 


Des  tract  Method:  ERASING 

Storage  Medium:  Magnetic,  Current-Accessed,  Plated  Wire 

Effect  1  veness :  Poor  to  Medium 

Process: 

Each  memory  location  is  addressed  and  overwritten  with  some  random  value. 
Destruction  Issues: 

System  Overhead  Concerns 
-  Physical  Characteristics 

Usually  exists  as  a  feature  of  the  information  processing  equipment 
.  Utility  requirements 

The  information  processing  equipment  must  be  operable. 


Safety  Concerns 
-  Accidental  trigger 

The  memory  contents  can  be  unintentionally  erased  if  the  "erase"  command  is  ac¬ 
cidentally  entered 


Risk  of  compromise 

-  Destruction  speed 

Depends  on  the  clocking  speed  of  the  information  processing  equipment  The  de- 
s tract  speed  also  depends  on  the  degree  of  erasure  required,  since  the  contents  should 
be  written  over  multiple  times  to  truly  remove  ah  remanents  of  die  previously  stored 
information. 

-  Throughput 

It  should  be  possible  to  overwrite  the  entire  memory  contents  a  sufficient  number 
times  in  the  span  of  a  few  minutes  to  preclude  recovery  of  the  previously  stored  in¬ 
formation. 

-  Premature  termination 

Possible  to  terminate  by  either  overriding  the  "erase"  command  or  by  removing  pow¬ 
er  to  die  information  processing  equipment 

-  Destruction  completeness 

Poor  to  medium.  If  die  information  has  been  stored  in  t  plated  wire  memory  for  a 
long  time  (exceeding  72  hours),  it  is  virtually  impossible  to  overwrite  the  memory 
contents  in  a  manner  that  precludes  the  recovery  of  the  previously  stored  information. 

-  Information  concentration 

The  information  is  located  within  the  memory  planes,  which  are  integral  to  the  in¬ 
formation  processing  equipment  As  such,  equipment  containing  plated  wire  memory 
modules  can  be  distributed  throughout  a  facility. 
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.  Medium  accessibility 

Not  an  issue  since  die  memory  elements  are  accessed  electronically  through  the  the 
information  processing  system  control  structure. 


State  of  Destruct  Technology 

Overwrite  technology  is  sn  existing  capability  of  most  information  processing  equip¬ 
ment 


Discussion: 

The  DoD- approved  method  for  declassifying  plated  wire  memory  calls  for  over¬ 
writing  all  addressable  data  locations  by  writing  any  one  character,  then  its  com¬ 
plement  alternately  for  1000  cycles,  followed  by  overwriting  with  unclassified  ran¬ 
dom  data.  This  procedure  is  effective  only  if  die  prior  information  had  been  stored 
for  less  than  72  hours.  Even  if  the  classified  information  has  been  stored  for  less 
than  72  hours,  the  random  unclassified  data  must  be  stored  for  at  least  72  hours  at  a 
temperature  matching  or  exceeding  the  temperature  present  during  the  storage  of  the 
classified  data.  Department  of  Defense  Magnetic  Remanence  Security  Guideline, 
National  Computer  Security  Center,  IS  November,  1985,  at  16. 
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Detfruct  Method:  ERASING 
Storage  Medium:  Magnetic,  Bubble 
Effectiveness:  High 

Process: 

A  current  pulse  is  applied  to  a  coil  in  the  bubble  memory  module  dial  sharply  raises 
the  perpendicular  bias  field,  causing  the  bubble  domains  to  collapse. 

Destruction  Issues: 

System  (W 

-  Physical  Characteristics 

Usually  exists  as  a  feature  of  die  information  processing  equipment 

-  Utility  requirements 

Although  a  current  pulse  is  required,  it  can  be  provided  by  a  capacitor  discharge  or 
batteries. 


Safety  Concerns 
-  Accidental  trigger 

The  memory  contents  can  be  accidentally  erased  if  the  current  pulse  is  accidentally 
triggered. 


Risk  erf  compromise 

-  Destruction  speed 

The  entire  contents  of  a  bubble  memory  can  be  completely  erased  in  microseconds. 

-  Throughput 

Depends  only  on  die  number  of  discrete  trigger  "buttons"  at  a  facility  and  how  rapidly 
personnel  can  get  to  them. 


-  Premature  termination 

Not  possible  once  initiated.  The  destruct  mechanism  can  be  disabled  if  the  wire  con¬ 
nections  from  the  trigger  point  to  the  memory  module  are  severed  prior  to  trigger. 

-  Destruction  completeness 

Excellent  The  memory  contents  are  completely  erased  with  no  remnants. 

-  Information  concentration 

The  information  is  located  within  the  memory  modules,  which  are  integral  to  the  in¬ 
formation  processing  equipment  As  such,  equipment  containing  bubble  memory 
modules  can  be  distributed  throughout  a  facility.  Furthermore,  compact  portable 
equipment  may  contain  bubble  memory  modules  and  it  may  be  difficult  to  rapidly  find 
this  equipment  in  an  emergency. 

-  Medium  accessibility 

Not  an  issue,  provided  the  equipment  is  pre-wired  so  that  the  perpendicular  bias 
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fields  of  the  bubble  memory  modules  can  be  triggered  without  having  to  access  the 
modules  themselves. 


State  of  Destruct  Technology 

Proven  technology  and  existing  feature  of  every  memory  module. 


Discussion: 

Magnetic  bubble  memories  are  extremely  well  suited  for  rapid  erasure  in  an  emer¬ 
gency. 


Destruct  Method:  ERASING 
Storage  Medium:  Optical,  Microform 
Effectiveness:  Not  applicable/'practical 

Discussion: 

There  is  no  way  to  erase  or  reverse  the  image  that  has  been  stored  on  microform  me¬ 
dia. 
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Destruct  Method:  ERASING 

Storage  Medium:  Optical  Stowage,  Laser-Accessed 

Effectiveness:  Not  applicable  or  practical 


Discussion: 

Even  though  some  laser-accessed  storage  media  are  being  designed  to  permit  users  to 
store  or  remove  information  from  the  storage  medium,  tms  process  is  not  practical  for 
emergency  situations.  Optical  storage  media  can  store  in  the  range  of  1  to  4  Gbytes 
of  Assuming  that  die  associated  drive  equipment  could  write  at  the  rate  of  1 
million  bits  per  second,  overwriting  the  entire  medium  would  require  from  2  to  8 
hours.  There  have  been  no  reports  of  methods  for  bulk  erasing  laser-accessed  optical 
media.  Similarly,  no  reports  on  remnants  following  overwriting  were  found. 


Destruct  Method:  ERASING 
Storage  Medium:  Punched,  All  Types 
Effectiveness:  Not  applicable/practical 


Discussion: 

In  punched  media,  information  is  represented  and  stored  by  the  pattern  of  punched 
boles.  The  holes  are  punched  in  precise  locations  following  standard  encoding 
schemes.  Once  the  holes  are  punched,  there  is  no  way  to  replace  the  material  that  has 
been  removed  and  to  return  the  medium  to  its  initial,  unused  condition.  The  medium 
can  be  overwritten  by  punching  out  all  the  possible  hole  locations,  thereby  obliterat¬ 
ing  the  stored  information.  This  process,  however,  is  very  slow  and,  therefore,  not 
practical. 
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Destruct  Method:  ERASING 
Storage  Medium:  Paper,  All  Types 
Effectiveness :  Not  applicable/practical 


Discussion: 

The  cost  of  paper  is  too  low  to  warrant  erasing  for  reuse.  As  such,  there  is  no  exist¬ 
ing  technology  base  to  apply  in  emergency  conditions.  Even  if  such  technology  did 
exist,  it  is  unlikely  that  the  process  would  be  rapid  or  thorough  enough  to  be  truly 
useful. 
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Generic  Description  of  HEAT  AND  INCINERATION 


Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  characteristics 

Destruction  by  heat  or  incineration  requires  some  mechanism  for  raising  the  tempera¬ 
ture  of  the  medium.  For  safety  reasons,  the  heat  must  be  generated  and  contained 
within  an  appropriate  container.  The  size  of  such  a  container  depends  on  the  specific 
implementation  and  can  vary  from  less  than  a  cubic  foot  to  many  cubic  feet  in  vol¬ 
ume. 

-  Utility  requirements 

A  source  of  heat,  adequate  ventilation,  and  a  method  fen’  isolating  die  heat  from  other 
flammable  materials  in  the  proximity  are  all  necessary. 

•  Manpower  requirements 

Personnel  may  be  needed  for  any  or  all  of  the  following:  to  transport  the  media  to  the 
incineration  point,  to  time  the  throughput,  or  to  trigger  the  destruct  mechanism. 


Safety  Concerns 

-  Process 

Unless  they  are  property  contained  and  vented,  smoke,  toxic  or  irritating  fumes,  heat, 
flames,  and  sparks  generated  by  combustion  can  injure  personnel.  The  heat,  flames 
and  sparks  can  cause  fire  to  spread  and  may  result  in  diunage  to  surrounding  struc¬ 
tural  elements. 

-  Materials 

The  pyrotechnic  materials  used  to  generate  heat  rapidly  and  support  the  incineration 
process  can  be  hazardous  to  store  and  handle.  Specific  hazards  depend  on  the  type 
and  quantity  of  the  incendiary  material. 

-  Accidental  trigger 

Media  storage  units  that  contain  the  incendiary  materials  and  serve  as  the  destruct 
container  are  more  prone  to  accidental  trigger.  On  the  other  hand,  incendiary  units 
that  require  material  to  be  transported  to  and  fed  into  the  unit  are  much  less  subject  to 
accidental  destruction. 

•  Emergency  environment 

Open  flames  and  smoke  increase  the  inherent  dangers  of  die  emergency  environment 
Smoke  obscures  visibility  while  the  flames  and  heat  can  caur e  the  spread  of  fire. 


Risk  of  compromise 
-  Destruction  speed 

The  extent  of  damage  inflicted  on  the  medium  depends  on  the  temperature  that  the 
medium  attains.  As  such,  the  destruction  speed  depends  on  how  fast  the  heat  source 
can  raise  all  parts  of  the  medium  to  a  certain  temperature.  If  the  medium  is  wound  on 


reels,  or  otherwise  compacted,  the  portions  of  the  medium  that  are  far  away  from  the 
heat  source  may  take  a  significantly  longer  amount  of  time  to  destroy. 

•  Throughput 

Dependent  on  the  specific  implementation.  Implementations  in  which  a  set  amount  of 
chemical  oxidizer  is  mounted  into  some  container  are  usually  limited  to  destroying  the 
material  that  was  in  the  container  at  the  initiation  of  the  bum.  A  "bum"  usually  lasts 
about  1/2  tour.  The  throughput  of  incinerators  that  permit  the  constant  addition  of 
both  fuel  and  media  depends  on  factors  such  as  the  size  of  the  incinerator,  the  form  of 
the  media  (compacted  or  loose),  and  the  personnels'  ability  to  identify,  collect,  and 
transport  tire  media  to  tire  incinerator. 

-  Premature  termination 

Unless  the  incineration  is  carried  out  in  a  sealed  container,  partially  destroyed  media 
can  be  pulled  out,  or  tire  fire  can  be  extinguished  before  sufficient  damage  is  inflicted. 
The  fire  can  be  extinguished  by  cutting  off  the  oxygen  supply  (unless  some  internal 
mum  of  generating  oxygen  is  provided)  or  dousing  tire  burning  material  with  extin¬ 
guishing  material. 

-  Destruction  completeness 

Depends  on  the  specific  medium-  inc  ineration  system  combination.  If  all  parts  of  the 
medium  are  not  sufficiently  heated,  information  may  still  be  recovered. 

-  Detectability 

Unless  they  are  removed  by  some  form  of  "scrubber”,  the  smoke  and  fumes  generat¬ 
ed  by  combustion  make  this  method  readily  detectable  from  the  outside. 


Information  concentration 

Depends  on  specific  medium-facility  factors.  Information  frequently  will  be  concen¬ 
trated  in  file  cabinets  or  bookcases.  Since  information  is  rarely  cataloged  and  stored 
by  sensitivity  category,  a  major  task  may  be  the  identification  and  separation  of  highly 
sensitive  information  from  less  sensitive  material 

Medium  accessibility 

Depends  on  specific  medium-facility -equipment  factors.  The  difficulty  and  complex¬ 
ify  of  accessing  media  is  set,  in  part,  by  the  specific  medium  and  whether  it  was  de¬ 
signed  to  be  fixed  or  removable.  The  removal  of  fixed  media  may  be  relatively  com¬ 
plex  and  may  require  special  tools  and  training.  Both  fixed  and  removable  media  may 
be  stored  in  secure  containers  or  housings,  which  in  turn  may  delay  accessing  the 
actual  media.  In  situations  where  a  chemical  dispensing  mechanism  is  built  integral  to 
the  equipment,  accessibility  is  not  a  major  factor. 


State  of  Destruct  Technology 

A  number  of  incineration  destruct  devices  have  been  designed  and  implemented. 
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Destruct  Method:  HEAT  AND  INCINERATION 
Storage  Medium:  Semiconductor,  All  Types 
Effectiveness:  Medium  to  High 

Process: 

The  temperature  of  the  semiconductor  memory  element  is  raised  to  a  level  at  which 
the  electronic  properties  of  the  device  are  altered  sufficiently  to  preclude  the  recovery 
of  any  stored  information. 

Destruction  Issues: 

Safety.  Concerns 

-  Materials 

The  plastic  packaging  materials  and  other  components  on  the  circuit  cards  may  emit 
toxic  or  irritating  fumes  when  heated 


Risk  of  compromise 

-  Throughput 

If  the  circuit  cards  containing  the  semiconductor  memory  devices  must  be  removed 
from  the  equipment  and  transported  to  some  common  incineration  point,  then 
throughput  will  be  determined  to  a  large  extent  on  the  personnel's  ability  to  perform 
this  activity.  If  the  pyrotechnics  are  mounted  integral  to  the  information  processing 
equipment,  then  the  throughput  will  be  determined  by  how  fast  the  personnel  can 
trigger  the  individual  units. 

-  Destruction  completeness 

If  die  temperature  of  a  semiconductor  device  is  not  raised  sufficiently  to  alter  the  elec¬ 
tronic  characteristics,  then  it  may  be  possible  to  extract  previously  stored  information. 

-  Medium  accessibility 

Semiconductor  memories  are  not  usually  user-accessible. 


State  of  Destruct  Technology 

No  systems  utilizing  incineration  for  the  destruction  of  information  stored  in  semi¬ 
conductor  memories  have  been  identified 


Discussion: 

The  most  commonly  used  semiconductor  material,  silicon,  melts  at  1410°C.  Even 
before  tins  temperature  is  reached,  the  information  content  of  the  device  can  be  ef¬ 
fectively  destroyed  Tire  metalizatkm  layer  is  usually  aluminum  which  melts  at  660°C 
(1220°F).  At  temperatures  below  the  melting  point,  complex  processes  take  place 
within  tire  semiconductor  material  and  the  various  dielectric  materials  that  comprise 
the  semiconductor  memory  device.  The  effects  of  high  temperatures  include  changes 
in  material  conductivity/resistivity.  Since  many  non-volatile  semiconductor  memories 
store  information  in  the  form  of  trapped  electrical  charge,  a  change  in  the  resistivity  of 
an  insulator  may  cause  the  charge  to  dissipate,  destroying  the  information  content. 
Furthermore,  since  the  more  exotic  information  reconstruction  techniques  that  can  be 
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used  to  read  information  that  had  been  stored  on  volatile  memories  rely  on  measuring 
very  small  changes  in  device  operating  parameters,  exposing  a  memory  to  higher 
temperatures  (several  hundred  degrees  Centigrade)  may  alter  device  operating  char¬ 
acteristics  sufficiently  to  preclude  accurate  measurement  of  the  parameters  necessary 
to  reconstruct  previously  stored  information.  Further  research  is  necessary  to  estab¬ 
lish  how  hot  a  semiconductor  device  must  get  before  the  information  that  had  beat 
stored  on  it  is  no  longer  retrievable. 

Circuit  boards  that  contain  a  layer  of  pyrotechnic  material  have  been  proposed  and 
fabricated.  Upon  trigger,  the  board  ignites  and  components  mounted  on  such  a  cir¬ 
cuit  board  are  severely  damaged.  It  is  unknown  whether  the  damage  inflicted  on 
semiconductor  memories  is  sufficient  to  preclude  information  recovery. 


Destruct  Method:  HEAT  AND  INCINERATION 


Storage  Medium:  Magnetic,  Recording,  Mylar  Substrate  (Reel-To-Reel,  Cassette,  Car¬ 
tridge,  Floppy  Disk,  Card) 

Effectiveness:  High 

Process: 

The  temperature  of  the  medium  is  raised  to  either  above  the  Curie  point,  or  to  a  level 
at  which  the  Mylar  base  disintegrates. 

Destruction  Issues: 

Safety  Concerns 
-  Materials 

The  pyrotechnic  materials  necessary  to  support  combustion  or  that  generate  sufficient 
heat  may  be  hazardous.  Aluminum  reels  in  conjunction  with  the  ferric  oxide  on  the 
media  may  present  an  explosion  hazard  if  they  are  incinerated  with  sodium  nitrate. 


Risk  of  compromise 

-  Throughput 

Throughput  is  affected  by  the  degree  of  media  compaction  -  tape  media  wound  on  a 
reels  bums  slower  than  loose  media. 

-  Destruction  completeness 

If  all  the  media  are  not  raised  to  above  the  Curie  point,  or  if  the  substrate  is  not  suffi¬ 
ciently  damaged,  the  information  will  still  be  extractable.  If  the  medium  is  tape  is 
wound  on  a  reel,  the  tracks  away  from  the  outside  edges  do  not  heat  as  fast  and  may 
be  incompletely  destroyed. 

-  Detectability 

Incineration  may  be  detectable  from  the  outside  due  to  generated  smoke  which  must 
be  vented.  Where  applicable,  heating  to  a  low  temperature  Curie  point  may  not  be 
associated  with  any  externally  observable  signs. 

-  Information  concentration 

Tape  media  will  frequently  be  found  in  central  "libraries";  other  magnetic  recording 
media  may  be  widely  distributed  throughout  a  facility. 

-  Medium  accessibility 

Mylar-based  media  are  usually  readily  accessible. 


State  of  Destruct  Technology 

No  systems  that  have  been  specifically  designed  for  destroying  magnetic  media  with 
heat  have  been  identified.  Incinerating  containers  that  have  been  designed  primarily 
for  paper  can  readily  destroy  magnetic  media.  Such  units  should  be  used  with  cau¬ 
tion  since  sodium  nitrate  (a  common  oxidizer),  ferric  oxide  (a  magnetic  medium),  and 
aluminum  (frequently  used  for  tape  reels  or  cartridge  components)  react  violently 
when  heated  and  explode.  Since  the  chromium  dioxide  medium  has  increased  in 
popularity  and  is  rapidly  becoming  the  new  "standard"  as  a  1/2  inch  cartridge  medi- 


urn,  research  into  systems  that  destroy  the  contents  by  elevating  the  temperature  rep¬ 
resents  a  potential  high  pay-off  research  area. 


Discussion: 

The  Curie  points  of  popular  magnetic  recording  media  vary  widely.  For  example,  the 
Curie  point  of  chromium  dioxide  is  only  about  135°C  (275°F),  while  that  of  gamma 
ferric  oxide  is  675 °C  (1247°F).  The  Mylar  substrate  is  destroyed  well  before  the  fer¬ 
ric  oxide  Curie  temperature  is  reached. 

Elevated  temperatures  have  a  profound  effect  on  Mylar 
12l°C  (250%)  Mylar  distorts; 

160°C  (320°F)  Mylar  and  binder  become  soft,  layer-to-layer  ad¬ 
hesion  in  wound  tapes  begins; 

288°C  (350°F)  Mylar  and  binder  darken  and  become  brittle; 

538°C  (1000°F)  Mylar  and  binder  char. 


Destruct  Method:  HEAT  AND  INCINERATION 

Storage  Medium:  Magnetic,  Recording,  Hard  Disk,  Removable  (Metal  Substrate) 
Effectiveness:  High 
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Process: 

The  temperature  of  the  medium  is  raised  to  either  above  the  Curie  point,  or  to  a  level 
at  which  die  metal  substrate  melts. 

Destruction  Issues: 

Safety  Concerns 

-  Materials 

The  aluminum  substrates,  in  conjunction  with  die  ferric  oxide  on  some  media,  may 
present  an  explosion  hazard  if  they  are  incinerated  with  sodium  nitrate. 


Risk  of  compromise 

-  Destruction  speed 

The  speed  with  which  removable  hard  disks  can  be  destroyed  depends  on  how  fast 
the  medium  can  be  collected  and  transported  to  the  incineration  point  Once  the 
medium  is  in  the  incineration  unit,  the  speed  with  which  the  medium  is  destroyed 
depends  on  how  fast  its  temperature  can  be  raised  to  die  necessary  level 

-  Destruction  completeness 

If  the  media  are  not  raised  to  above  the  Curie  point,  or  if  the  substrate  is  not  suffi¬ 
ciently  damaged,  die  information  will  still  be  extractable. 

-  Detectability 

Incineration  may  be  detectable  from  the  outside  due  to  generated  smoke  which  must 
be  vented.  Where  applicable,  heating  to  a  low  temperature  Curie  point  may  not  be 
associated  with  any  externally  observable  signs. 

•  Information  concentration 

Removable  hard  disk  media  are  usually  found  in  close  proximity  to  the  device  that 
they  are  used  with  or  in  media  libraries. 

-  Medium  accessibility 

Unless  they  are  locked  in  secure  containers,  removable  hard  disk  media  are  usually 
readily  accessible. 


State  of  Destruct  Technology 

No  systems  that  have  been  specifically  designed  for  destroying  removable  hard  disk 
media  with  heat  have  been  identified.  Incinerating  containers  that  have  been  designed 
primarily  for  paper  can  readily  destroy  magnetic  media.  Such  units  should  be  used 
with  caution  since  sodium  nitrate  (a  common  oxidizer),  ferric  oxide  (a  magnetic 
medium),  and  aluminum  (frequently  used  for  tape  reels  or  cartridge  components)  re¬ 
act  violently  when  heated  and  explode. 
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Discussion: 

The  Curie  points  of  popular  magnetic  recording  media  vary  widely.  For  example,  die 
Curie  point  of  chromium  dioxide  is  only  about  135°C  (275°F),  while  that  of  gamma 
feme  oxide  is  675°C  (1247°F). 

The  melting  point  of  aluminum,  die  most  common  substrate  material  is  about  660°C 
(1220°F);  the  exact  temperature  depends  on  the  specific  alloy  used. 


G-9 


Destruct  Method:  HEAT  AND  INCINERATION 

Storage  Medium:  Magnetic,  Recording,  Hard  Disk,  Fixed  (Metal  Substrate) 

Effectiveness:  Medium  (low  Curie  point  media)  to  Poor  (high  Curie  point  media) 

Process: 

The  temperature  of  the  medium  is  raised  to  either  above  die  Curie  point,  or  to  a  level 
at  which  the  metal  substrate  melts. 

Destruction  Issues: 

Safety  Concerns 

-  Material*! 

Aluminum  substrates,  in  conjunction  with  the  ferric  oxide  used  on  some  media,  may 
present  an  explosion  hazard  if  sodium  nitrate  is  the  oxidizing  material. 

-  Accidental  trigger 

Since  the  heat  generating  materials  or  mechanism  need  to  be  mounted  integral  to  the 
disk  drive  unit,  there  exists  a  possibility  of  accidental  trigger. 


Risk  of  compromise 

-  Throughput 

Since  each  destruct  mechanism  is  integral  to  the  disk  drive  unit,  the  throughput  will 
be  determined  by  how  fast  the  personnel  can  trigger  die  individual  units. 

-  Destruction  completeness 

If  the  media  are  not  raised  to  above  the  Curie  point,  or  if  the  substrate  is  not  suffi¬ 
ciently  damaged,  the  information  will  still  be  extractable. 

-  Detectability 

Where  applicable,  heating  to  a  low  temperature  Curie  point  may  not  be  associated 
with  any  externally  observable  signs. 

-  Medium  accessibility 

Fixed  hard  disk  media  are  not  user-accessible. 


State  of  Destruct  Technology 

We  have  not  found  any  manufacturer  making  fixed  hard  disk  storage  systems  with  an 
integral,  heat  generating  destruct  capability.  Secure  Data  Corporation  of  Scottsdale, 
AZ,  however,  has  developed  a  method  for  integrating  several  Winchester-type  hard 
disk  units  into  a  GSA-approved,  Mosler  Class  6  security  filing  cabinet.  Since 
Unidynamics  of  Phoenix,  AZ  makes  incinerating  containers  based  on  a  Mosler  cabi¬ 
net,  it  may  be  possible  to  combine  die  technology  of  these  two  units  to  create  an  in¬ 
cinerating  safe  for  certain  types  of  fixed  hard  disk  media. 

Discussion: 

The  Curie  points  of  popular  magnetic  recording  media  vary  widely.  For  example,  the 
Curie  point  of  chromium  dioxide  is  only  about  135°C  (275°F),  while  that  of  gamma 
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ferric  oxide  is  675 °C  (1247°F).  It  should  be  relatively  simple  to  design  a  disk  drive 
that  uses  low  Curie  point  media  with  an  electric  heating  element  that  could  raise  the 
internal  temperature  of  the  disk  drive  unit  to  above  the  Curie  point  If  the  recording 
medium  were  to  have  a  Curie  point  at  275°F  (chromium  dioxide),  such  an  oven-like 
unit  could  be  relatively  safe  and  simple. 

The  melting  point  of  aluminum,  the  most  common  hard  disk  substrate  material  is 
about  660°C  (1220°F);  the  exact  melting  temperature  depends  on  the  specific  alloy 
used. 
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Destract  Method:  HEAT  AND  INCINERATION 
Storage  Medium:  Magnetic,  Recording,  Drum 
Effectiveness:  Not  applicable/practical 

Discussion: 

Magnetic  drums  are  hermetically  sealed  units  that  are  usually  integral  to  the  informa¬ 
tion  processing  equipment  This  technology  is  obsolete  and  only  remains  in  older, 
fielded  equipment  Since  drums  are  no  longer  used  in  new  equipment  a  research  ef¬ 
fort  on  how  to  destroy  drums  with  heat  and  incineration  is  not  warranted.  Retro-fit¬ 
ting  existing  equipment  to  include  an  internal  destruct  mechanism  would  virtually  re¬ 
quire  a  custom  designed  destruct  system  for  each  drum  unit  Accessing  and  remov¬ 
ing  a  drum  in  order  to  place  it  into  some  incinerating  device  is  time  consuming  and 
not  practical  under  emergency  conditions. 
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Destruct  Method:  HEAT  AND  INCINERATION 

Storage  Medium:  Magnetic,  Current-Accessed  (Core,  Twistor,  Plated  Wire) 

Effectiveness:  Possibly  high 

Process: 

The  temperature  of  die  medium  is  raised  to  either  above  the  Curie  point  of  the  ferrite 
cores,  or  to  a  level  at  which  the  wire  address  lines  melt. 

Destruction  Issues: 

Safety  Concerns 

-  Accidental  trigger 

Since  the  heat  generating  materials  or  mechanism  need  to  be  mounted  integral  to  the 
memory  unit  there  exists  a  possibility  of  accidental  trigger. 


Risk  of  compromise 

-  Throughput 

Since  each  destruct  mechanism  is  integral  to  the  memory  unit  the  throughput  will  be 
determined  by  how  fast  the  personnel  can  trigger  the  individual  units. 

-  Destruction  completeness 

If  the  storage  media  components  are  not  raised  to  above  their  Curie  point,  or  if  the 
address  lines  are  not  molten  and  the  storage  elements  physically  randomized,  the  in¬ 
formation  could  possibly  still  be  extractable. 

-  Medium  accessibility 

Memories  are  usually  housed  within  the  processing  equipment  chassis  and  are  not 
user-accessible. 


State  of  Destruct  Technology 

No  heat  destruct  mechanisms  designed  specifically  for  current  addressed  memories 
have  been  identified.  Incineration  equipment  designed  for  destroying  paper  media 
could  be  used  for  destroying  current  addressed  memories  but  the  memory  planes 
would  first  have  to  be  physically  removed  from  the  equipment 


G-13 


Destruct  Method: 
Storage  Medium: 
Effectiveness: 


HEAT  AND  INCINERATION 
Magnetic,  Bubble 
Unknown 


Discussion: 

Bubble  memories  are  packaged  as  an  integral,  hermetically  sealed  unit  containing 
permanent  magnets  for  the  bias  field,  the  bubble  material  die,  and  drive  coils  for  the 
rotating  in-plane  field  The  effect  of  heat  on  the  bubble  material  die  storing  the  infor¬ 
mation  needs  further  research.  It  can  be  conjectured  that  as  the  temperature  of  the 
module  rises,  the  magnetic  field  strength  of  die  permanent  magnets  will  decrease,  and 
at  some  point  the  field  will  be  insufficient  to  support  the  magnetic  domains. 
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Destruct  Method:  HEAT  AND  INCINERATION 
Storage  Medium:  Optical,  Microform 
Effectiveness:  High 

Process: 

The  temperature  of  the  medium  is  raised  to  a  level  at  which  the  microform  film  base 
melts  or  bums. 

Destruction  Issues: 

Safety  Concerns 

-  Process 

Fumes  evolved  by  the  plastic  microform  film  base  during  combustion  may  be  toxic  or 
irritating. 


Risk  of  compromise 

-  Destruction  speed 

If  the  film  is  wound  on  reels,  or  if  large  quantities  of  stacked  microfiche  media  are  to 
be  destroyed  at  once,  some  portions  of  the  media  may  be  far  away  from  the  heat 
source  and  therefore,  may  take  a  significantly  longer  amount  of  time  to  destroy. 

-  Destruction  completeness 

If  all  the  media  are  not  raised  to  a  point  where  the  film  base  transforms  into  ash  (or  a 
molten  mass),  information  may  still  be  extractable. 

•  Information  concentration 

Microforms  are  small  and  highly  portable.  Microfilm  on  reels  tends  to  be  housed  in 
protective  boxes  and  stored  in  special  file  cabinets.  Microfiche  are  housed  in  protec¬ 
tive  paper  sleeves  and  are  likewise  frequently  stored  in  cabinets.  Because  they  are  flat 
and  readily  available  in  "user  copies,"  microfiche  tend  to  be  distributed  throughout  a 
facility:  in  desk  drawers,  in  files,  etc. 

-  Medium  accessibility 

Microform  media  are  usually  readily  accessible  unless  stored  in  secure  containers. 


State  of  Destruct  Technology 

Incinerating  containers  that  have  been  designed  primarily  for  paper  can  readily  de¬ 
stroy  microform  media.  Security  Engineered  Machinery  Corporation  used  to  manu¬ 
facture  a  small,  electric  desktop  unit  that  destroyed  microforms  by  melting  them.  The 
unit  could  handle  several  sheets  at  a  time  and  took  about  30  minutes  to  cycle.  This 
product  has  been  discontinued. 


Discussion: 

Old  film  base  used  to  be  nitrocellulose  which  burned  very  vigorously.  Because  of 
this  flammability,  nitrocellulose  is  no  longer  used.  Present  day  film  bases  do  not  ig¬ 
nite  easily,  but  once  lit,  they  will  bum,  dripping  flaming  molten  plastic  material. 
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Destruct  Method:  HEAT  AND  INCINERATION 
Storage  Medium:  Optical,  Laser- Accessed 
Effectiveness:  Unknown 


Discussion: 

Laser-accessed  information  storage  is  a  new  and  rapidly  evolving  technology.  As 
such,  no  dominant  product  types  have  yet  evolved.  Media  configurations  are  still 
highly  proprietary  and  experimental.  Without  specific  details  as  to  media  construction 
and  materials  (e.g.,  metal  plastic,  glass),  it  is  difficult  to  predict  if  and  how  heat 
would  affect  the  information  content  Since  inf  carnation  storage  is  accomplished  by 
heating  a  localized  area  of  the  disk  surface  to  change  its  characteristics,  thereby  repre¬ 
senting  information,  it  can  be  conjectured  that  heat  would  be  effective  at  destroying 
the  information  content  of  laser  accessed  optical  storage  media.  Further  research  is 
necessary  to  determine  how  much  heat  is  necessary  and  what  is  the  best  method  of 
applying  this  heat 
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Destruct  Method:  HEAT  AND  INCINERATION 
Storage  Medium:  Punched,  Paper-Based  (Cards,  Tape) 

Effectiveness:  High 

Process: 

The  temperature  of  the  paper-based  punched  medium  is  raised  until  it  ignites  and 
bums. 

Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  Characteristics 

Paper-based  punched  media  are  burned  in  some  form  of  open  or  sealed  container. 
The  size  of  the  container  can  be  highly  variable.  A  common  container  form  factor  is 
the  security  file  cabinet 

-  Utility  requirements 

Combustion  requires  a  source  of  oxygen  and  some  conduit  for  venting  the  generated 
smoke  and  fumes.  About  0.83  pounds  of  oxygen  are  required  to  bum  one  pound  of 
paper-based  media.  The  container  must  be  insulated  from  its  surroundings  to  prevent 
scorching  or  fire. 

-  Manpower  requirements 

Personnel  are  required  to  collect  the  media,  transport  them  to  the  destruct  equipment 
and  to  feed  them  into  die  device.  Destruct  devices  that  also  serve  as  medium  storage 
containers  require  less  manpower  to  implement  destruction. 


Risk  of  compromise 

-  Destruction  speed 

Depends  on  the  quantity  of  paper-based  punched  media,  and  the  properties  of  the  in¬ 
cendiary  material.  In  general,  however,  since  punched  cards  consist  of  99  pound 
stock,  and  tend  to  be  stored  in  tight  stacks,  the  speed  of  destruction  of  punched  cards 
will  be  significantly  slower  than  that  of  a  comparable  volume  of  paper.  Similarly, 
punched  tapes  that  are  wound  on  reels  will  take  longer  to  destroy  than  loose  tapes. 
The  oil  content  of  some  paper  tapes  may  enhance  the  combustion  process. 

-  Destruction  completeness 

If  combustion  proceeds  to  completion,  the  medium  is  usually  completely  destroyed. 
Paper,  however,  is  a  relatively  good  insulator,  and  if  stacks  of  punched  cards,  or 
reels  of  punched  tape  are  burned  without  stoking,  large  sections  of  the  interior 
material  may  remain  undamaged.  If  combustion  is  carried  out  outdoors  in  uncovered 
containers,  updrafts  can  actually  cause  paper  to  fly  out  of  the  container  and  disperse 
over  the  surrounding  area. 

-  Information  concentration 

Punched  cards  tend  to  be  stored  in  file  cabinets  designed  for  their  size,  cardboard 
boxes  holding  up  to  2,000  cards,  or  in  stacks  simply  bound  with  elastic  brads.  Al¬ 
though  cards  can  be  located  virtually  anywhere  in  a  facility,  they  tend  to  be  in  discreet 
clusters.  Punched  tapes  tend  to  be  stored  on  reels  up  to  14  inches  in  diameter,  as 
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coils,  or  fanfolded  in  containers. 

Medium  accessibility 

Readily  accessible  unless  stored  in  secure  containers.  The  major  difficulty  is  not  get¬ 
ting  to  die  material,  but  rather  separating  the  sensitive  material  from  die  sheer  volume 
of  other  material. 


State  of  Destruct  Technology 

A  number  or  different  versions  of  incendiary  units  have  been  developed,  tested  and 
implemented. 


Discussion: 

Secure  containers  with  internal  combustion  mechanisms  represent  a  potentially  high 
payoff  research  area. 
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Destruct  Method:  HEAT  AND  INCINERATION 
Storage  Medium:  Punched,  Mylar-Based 
Effectiveness:  High 


Process: 

The  temperature  of  the  medium  is  raised  to  a  level  at  which  the  Mylar  disintegrates. 
Destruction  Issues: 

Risk  of  compromise 

-  Destruction  speed 

The  extent  of  damage  inflicted  on  the  medium  depends  on  the  temperature  that  the 
Mylar  attains.  As  such,  the  destruction  speed  depends  on  how  fast  the  heat  source 
can  raise  all  parts  of  the  punched  mylar  tape  medium  to  a  certain  temperature. 

-  Destruction  completeness 

If  all  the  media  are  not  raised  to  a  point  where  the  mylar  transforms  into  ash,  infor¬ 
mation  may  still  be  extractable. 

-  Information  concentration 

Punched  tapes  tend  to  be  stored  on  reels  up  to  14  inches  in  diameter,  as  coils,  or  fan- 
folded  in  containers. 

-  Medium  accessibility 

Mylar-based  punched  tape  media  are  usually  readily  accessible. 


State  of  Destruct  Technology 

Incinerating  containers  that  have  been  designed  primarily  for  paper  can  readily  de¬ 
stroy  Mylar-based  punched  tape  media. 


Discussion: 


Elevated  temperatures  have  a  profound  effect  on  Mylar: 


mpei 
121°C 
160°C 

288°C 

538°C 


(250°F)  Mylar  distorts; 

(320°F)  Mylar  becomes  soft,  layer-to-layer  adhesion  in 
wound  tapes  begins; 

(350°F)  Mylar  darkens  and  becomes  brittle; 

( 1000°F)  Mylar  chars. 


» 
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Destruct  Method:  HEAT  AND  INCINERATION 
Storage  Medium:  Paper,  All  Types 
Effectiveness:  High 


Process: 

The  temperature  of  the  paper  medium  is  raised  until  it  ignites  and  bums. 

Destruction  Issues: 

System  Overhead  Concerns 

-  Physical  Characteristics 

Paper  is  burned  in  some  form  of  open  or  sealed  container.  The  size  of  the  container 
can  be  highly  variable.  A  common  container  form  factor  is  die  security  file  cabinet 

•  Utility  requirements 

Combustion  requires  a  source  of  oxygen  and  some  conduit  for  venting  the  generated 
smoke  and  fumes.  About  0.83  pounds  of  oxygen  are  required  to  bum  one  pound  of 
paper.  The  container  must  be  insulated  from  its  surroundings  to  prevent  scorching  or 
fire. 

-  Manpower  requirements 

Personnel  are  required  to  collect  the  media,  transport  them  to  the  destruct  equipment, 
and  feed  them  into  the  device.  Destruct  devices  that  also  serve  as  medium  storage 
containers  require  less  manpower  to  implement  destruction. 


Risk  of  compromise 

-  Destruction  speed 

Depends  on  the  quantity  of  paper,  its  weight,  degree  of  compaction,  and  the  proper¬ 
ties  of  the  incendiary  material. 

-  Destruction  completeness 

If  combustion  proceeds  to  completion,  the  medium  is  usually  completely  destroyed. 
Paper,  however,  is  a  relatively  good  insulator,  and  when  items,  such  as  bound  vol¬ 
umes  or  thick  stacks  of  paper,  are  burned  without  stoking,  large  sections  of  the  inte¬ 
rior  material  may  remain  undamaged.  If  combustion  is  carried  out  outdoors  in  un¬ 
covered  containers,  updrafts  can  actually  cause  paper  to  fly  out  of  the  container  and 
disperse  over  the  surrounding  area. 

-  Information  concentration 

Paper  tends  to  be  randomly  distributed  everywhere  throughout  a  facility.  Some  de¬ 
gree  of  information  concentration  exists  in  the  form  of  file  cabinets. 

-  Medium  accessibility 

Read ily  accessible  unless  stored  in  secure  containers.  The  major  difficulty  is  not  get¬ 
ting  to  die  material,  rather  separating  the  sensitive  material  from  the  sheer  volume  of 
other  material. 
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State  of  Destruct  Technology 

A  number  or  different  versions  of  incendiary  units  have  been  developed,  tested  and 
implemented. 


Discussion: 

Secure  containers  with  internal  combustion  mechanisms  represent  a  potentially  high 
payoff  research  area. 


G-21 


DttrMlea  List  for  IDA  Report  R-321 


NAME  AND  ADDRESS 


CDR  Thomas  Taylor 

Space  and  Naval  Warfare  Command 

Code  3214C 

Washington,  D.C.  20365-5100 
Dr.  Sylvan  Pinsky 

National  Computer  Security  Center  (C33) 
9800  Savage  Rd. 

Ft.  George  G.  Meade,  MD  20755-6000 
Other 

Defense  Technical  Information  Center 
Cameron  Station 
Alexandria,  VA  22314 

Dr.  Lara  Baker 

Information  Handling  Committee 
Intelligence  Community  Staff 
Washington,  D.C.  20505 

Dr.  Ed  Burke 

Laboratory  for  Physical  Sciences 
4928  College  Av. 

College  Park,  MD  20740 

Paul  D.  Ewing 
Bldg.  3508 
P.O.  Box  X 

Oak  Ridge,  TN  37831-6318 

LTC  John  E.  Hatlelid 
Defense  Intelligence  Agency 
DT-SAC 

Washington,  D.C.  20301-6111 

Mr.  George  Jellen 
416  Old  Stone  Rd. 

Silver  Spring,  MD  20904 


NUMBER  OF  COPIES 


5 


3 


2 


1 


1 


1 


1 


1 


NAME  AND  ADDRESS 

Or.  Robert  Kiel! 

OASDC3I 
Room  3E187 
The  Pentagon 
Washington,  D.C.  20310 

Mr.  Jack  Leahy 
National  Security  Agency 
Communications  Security  Organization 
Ft.  George  G.  Meade,  MD  20755-6000 

Mr.  Mike  McLaughlin 
OPNAV  OP-945 
Washington,  D.C.  20350 

Mr.  Lynn  McNulty 
State  Department  Chief 
Information  Systems  Security  Division 
P.O.Box  18014 
Washington,  D.C.  20036 

Mr.  William  Norman 
New  Zealand  Embassy 
37  Observatory  Circle,  N.W. 
Washington,  D.C.  20008 

Ms.  Debbie  Nottingham 
Naval  Security  Group 
3801  Nebraska  Av.,  N.W. 

Washington,  D.C.  20390 

Mr.  Tom  Nugent 

Naval  Regional  Automation  Command 

CodeOOTX 

Box  111 

Jacksonville,  FL  32212 
Dr.  Paul  Peters 

National  Computer  Security  Center 
9800  Savage  Rd. 

Ft.  George  G.  Meade,  MD  20755-6000 


NUMBER  OF  COPIES 

1 

1 

1 

1 

1 

1 

1 


1 


NAME  AND  ADDRESS 

Ms.  Suzanne  Shock 
Defense  Nuclear  Agency 
Security/Intelligence  Directorate 
6801  Telegraph  Rd. 

Alexandria,  VA  20305-1000 

Dr.  Marco  Shisarczuk 
943  South  26th  St. 

Arlington,  VA  22202 

CSED  Review  Panel 

Dr.  Dan  Alpert,  Director 
Center  for  Advanced  Study 
University  of  Illinois 
912  W.  Illinois  Street 
Urbana,  Illinois  61801 

Dr.  Barry  W.  Boehm 
TRW  Defense  Systems  Group 
MS  2-2304 
One  Space  Park 
Redondo  Beach,  CA  90278 

Dr.  Ruth  Davis 
The  Pymatuning  Group,  Inc. 
2000  N.  15th  Street,  Suite  707 
Arlington,  VA  22201 

Dr.  Larry  E.  Druffel 
Software  Engineering  Institute 
Carnegie-Mellon  University 
Pittsburgh,  PA  15213-3890 

Dr.  C.E.  Hutchinson,  Dean 
Thayer  School  of  Engineering 
Dartmouth  College 
Hanover,  NH  03755 


NUMBER  OF  COPIES 
1 

1 

1 

1 

1 

1 


1 


NAME  AND  ADDRESS 


Mt  A.J.  Jordano 

Manager;  Systems  &  Software 
Engineering  Headquarters 
Federal  Systems  Division 
6600  Rockledge  Dr. 

Bethesda,  MD  20817 

Mr.  Robert  K.  Lehto 

Mainstay 

302  Mill  St. 

Occoquan,  VA  22125 

Mr.  Oliver  Selfridge 
45  Percy  Road 
Lexington,  MA  02173 

IDA 

General  W.Y.  Smith,  HQ 
Mr.  Philip  Major,  HQ 
Dr.  Robert  E.  Roberts,  HQ 
Mr.  Andrew  W.  Hull,  STD 
Dr.  John  F.  Kramer,  CSED 
Dr.  John  Salasin,  CSED 
Ms.  Anne  Douville,  CSED 
Mt  Terry  Mayfield,  CSED 
Ms.  Audrey  A.  Hook,  CSED 
Dr.  Richard  Morton,  CSED 
Ms.  Katydean  Price,  CSED 
IDA  Control  &  Distribution  Vault 


number  of  copies 
1 


1 


1 


1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

2 


